Skip to content

Add support for Release Please monorepo tags for SHA-pinned GH Actions - #15747

Open
kelmansoury wants to merge 1 commit into
dependabot:mainfrom
kelmansoury:support-release-please
Open

Add support for Release Please monorepo tags for SHA-pinned GH Actions#15747
kelmansoury wants to merge 1 commit into
dependabot:mainfrom
kelmansoury:support-release-please

Conversation

@kelmansoury

@kelmansoury kelmansoury commented Aug 1, 2026

Copy link
Copy Markdown

What are you trying to accomplish?

This change adds support for Release Please monorepo tag formats in GitHub Actions dependency resolution.

The main problem is that SHA-pinned GitHub Actions in a monorepo can use tags like component-name-v1.2.3, which are not valid full Gem::Version strings. Dependabot was previously rejecting those tags or falling back to the branch HEAD SHA instead of the correct tagged release version. This change makes version detection and SHA-to-tag resolution work for those monorepo-style tags.

Anything you want to highlight for special attention from reviewers?

N/A

How will you know you've accomplished your goal?

  • The update checker now returns the latest version for the action-specific tag prefix.
  • It does not incorrectly resolve to the branch HEAD SHA.
  • The implementation is verified through the new spec coverage in update_checker_spec.rb using the fixture github-monorepo-release-please.

Checklist

  • I have run the complete test suite to ensure all tests and linters pass.
  • I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
  • I have written clear and descriptive commit messages.
  • I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
  • I have ensured that the code is well-documented and easy to understand.
@kelmansoury
kelmansoury requested a review from a team as a code owner August 1, 2026 18:56
@github-actions github-actions Bot added the L: github:actions GitHub Actions label Aug 1, 2026
@kelmansoury
kelmansoury force-pushed the support-release-please branch 3 times, most recently from dd3d559 to eeb18f4 Compare August 1, 2026 23:10
@kelmansoury
Add support for Release Please monorepo tags for SHA-pinned GH Actions
7e56aea 
- Relax tag matching in `common/lib/dependabot/git_commit_checker.rb`
  so SHA-based version resolution also accepts monorepo-style tags such as
  `component-name-v1.2.3` by extracting the trailing version segment.
- Harden update rewriting in `github_actions/lib/dependabot/github_actions/file_updater.rb`
  so it only rewrites comments using valid version tags and avoids partial matches
  from shorter tag suffixes.
- Add regression coverage in `github_actions/spec/dependabot/github_actions/update_checker_spec.rb`
  for SHA-pinned Release Please actions and the new fixture
  `github_actions/spec/fixtures/git/upload_packs/github-monorepo-release-please`.
@kelmansoury
kelmansoury force-pushed the support-release-please branch from eeb18f4 to 7e56aea Compare August 1, 2026 23:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

L: github:actions GitHub Actions

1 participant

@kelmansoury