Safeguard
Developer Tools•

Does a starter workflow update after you copy it into your repo?

A starter workflow is copied once. It never updates itself, so your CI file can drift from upstream fixes. Here is how to notice and refresh it.

Safeguard Security Team
3 min read

No. A starter workflow is copied into your repository as an ordinary file, and nothing keeps it linked to the original. If GitHub improves the template later, your copy stays as it was. You have to compare and refresh it yourself, on a schedule you choose.

Copied, not linked

GitHub's guide describes the flow plainly: pick a template, click Configure, optionally edit, and commit. At that point the file is yours. There is no subscription to the template and no automatic pull request when it changes.

The same holds for templates your organization publishes from its .github repository. A later edit there does not reach repositories that already used the template.

What drifts

Over a year, a copied workflow can fall behind in four places:

  • Action versions. The actions it calls release fixes, and your pinned or tagged reference stays still.
  • Runtime versions. A language version in a setup step may reach end of life.
  • Security practice. Guidance such as token permissions and pinning evolves, and older files may not follow it.
  • Template structure. The upstream template may add or drop steps.

None of this breaks the build today. It shows up as a surprise in an audit or an incident.

How to refresh without breaking things

  1. Let a bot handle action versions. GitHub documents Dependabot version updates for actions and reusable workflows referenced in your repository. It opens pull requests, so every bump is reviewed.
  2. Run a yearly diff. Open the current starter workflow for your language and compare it with your file. Read the differences, then decide which ones you want.
  3. Review the runtime. Check the language or tool version in the setup step against the supported versions for that project.
  4. Record the source. Add a comment at the top naming the template and the date you copied it. Future you will be grateful.

If you own the template

When your organization publishes templates, drift is your problem to manage at scale. Version changes, announce them, and give teams a short list of what to update. See versioning and rolling out changes to a shared pipeline template for a practical approach. If you want updates to flow automatically, a reusable workflow that repositories call is a different design from a copied template.

Try it yourself

Click through it at your own pace, or open it full screen. The idea to notice: a clean result today says little about next month, which is also true of a workflow file nobody revisits.

Quick check

Will Dependabot update my whole starter workflow?

No. It updates versions of actions and reusable workflows that the file references. It does not rewrite the structure of the workflow.

Is drift a security problem or just housekeeping?

Both. Old action references and old permission habits can leave known issues in place, so treat the review as part of dependency hygiene.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.