No. A starter workflow is copied into your repository as an ordinary file, and nothing keeps it linked to the original. If GitHub improves the template later, your copy stays as it was. You have to compare and refresh it yourself, on a schedule you choose.
Copied, not linked
GitHub's guide describes the flow plainly: pick a template, click Configure, optionally edit, and commit. At that point the file is yours. There is no subscription to the template and no automatic pull request when it changes.
The same holds for templates your organization publishes from its .github repository. A later edit there does not reach repositories that already used the template.
What drifts
Over a year, a copied workflow can fall behind in four places:
- Action versions. The actions it calls release fixes, and your pinned or tagged reference stays still.
- Runtime versions. A language version in a setup step may reach end of life.
- Security practice. Guidance such as token permissions and pinning evolves, and older files may not follow it.
- Template structure. The upstream template may add or drop steps.
None of this breaks the build today. It shows up as a surprise in an audit or an incident.
How to refresh without breaking things
- Let a bot handle action versions. GitHub documents Dependabot version updates for actions and reusable workflows referenced in your repository. It opens pull requests, so every bump is reviewed.
- Run a yearly diff. Open the current starter workflow for your language and compare it with your file. Read the differences, then decide which ones you want.
- Review the runtime. Check the language or tool version in the setup step against the supported versions for that project.
- Record the source. Add a comment at the top naming the template and the date you copied it. Future you will be grateful.
If you own the template
When your organization publishes templates, drift is your problem to manage at scale. Version changes, announce them, and give teams a short list of what to update. See versioning and rolling out changes to a shared pipeline template for a practical approach. If you want updates to flow automatically, a reusable workflow that repositories call is a different design from a copied template.
Try it yourself
Click through it at your own pace, or open it full screen. The idea to notice: a clean result today says little about next month, which is also true of a workflow file nobody revisits.
Quick check
Will Dependabot update my whole starter workflow?
No. It updates versions of actions and reusable workflows that the file references. It does not rewrite the structure of the workflow.
Is drift a security problem or just housekeeping?
Both. Old action references and old permission habits can leave known issues in place, so treat the review as part of dependency hygiene.
Sources
- Using workflow templates, GitHub Docs
- Creating workflow templates for your organization, GitHub Docs
- Secure use reference, GitHub Docs
Last reviewed: 19 October 2026.