Add a github-actions entry to .github/dependabot.yml and Dependabot will open pull requests when the actions and reusable workflows your pipelines use have newer versions. Pair it with commit SHA pinning so that every update is a reviewed change and never a silent one.
Why bother
Workflows depend on other people's code, just like applications do. An action you used last year may have fixed security bugs since. If nobody updates references, you either run old code or someone bumps versions by hand and forgets.
The configuration
GitHub's documentation gives this example:
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
The steps: create or open dependabot.yml in .github, set the ecosystem to github-actions, set the directory to the root so it checks .github/workflows, choose a schedule, and commit.
Dependabot keeps two things current: action references in workflow files, and reusable workflows your workflows call.
Pinned references
GitHub recommends pinning actions to a full length commit SHA, because tags can be moved or deleted if the action's repository is compromised. The page on Dependabot for actions did not say how it treats SHA pinned references, so confirm in the Dependabot options reference and test on one repository. See how to pin actions to SHAs correctly.
GitHub's secure use page also describes a workflow dependency lockfile as the strongest protection where your repository can adopt it, and says it supersedes SHA pinning. Check whether it is available to you.
What to review in each pull request
Do not merge update pull requests on autopilot. A quick checklist:
- Is the new version from the same repository as before, not a fork?
- Does the changelog explain the change?
- Did the permissions the action asks for change?
- Did the action add new network calls or new inputs?
- If pinned by SHA, does the SHA belong to the tagged release in the original repository?
Small actions you do not recognize are worth a look at the source. GitHub's guidance says to audit an action's code to confirm it handles secrets and repository content as expected.
Tuning the noise
Weekly is a good start. Daily creates churn. You can group updates in the Dependabot configuration, but I did not fetch that option's documentation here, so check the options reference.
Where it fits in a gate
Dependabot opens the pull request. Your required checks and code owner review decide whether it merges. See CODEOWNERS for workflow files.
Safeguard dependency scanning and autonomous remediation with fix pull requests (off by default) cover application dependencies as well. You can start with the free scan at gold.safeguard.sh/scan.
Quick check
Does Dependabot update reusable workflows?
Yes. GitHub documents that it updates action references and the reusable workflows your workflows use.
How often should it run?
Weekly is a reasonable start. Increase only if you can review the volume.
Sources
Last reviewed: 19 October 2026.
