Sq Actions Dependabot

DevOps & Security

sq-actions-dependabot

Sq Actions Dependabot is an Agent Skill for devops & security published in the neilotoole/sq repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Reviews and merges Dependabot pull requests for GitHub Actions (the github-actions ecosystem) that bump `uses:` pins in `.github/workflows/`. Use for Dependabot github_actions PRs (branches like `dependabot/github_actions/...`), not go.mod or site/ Bun PRs.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/neilotoole/sq/blob/HEAD/.agents/skills/sq-actions-dependabot/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/sq-actions-dependabot, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

sq-actions-dependabot

Maintainer workflow for Dependabot PRs in the github-actions ecosystem: version bumps to uses: action pins under .github/workflows/. For go.mod / go.sum PRs use sq-gomod-dependabot; for site/ Bun/Hugo PRs use sq-site-dependabot.

Actions are pinned by full commit SHA with a trailing # vX tag comment (for example docker/login-action@650006c... # v4). Dependabot bumps the SHA and the comment together; confirm they stay in sync.

No lockfile is involved, so action PRs are loosely coupled. Two PRs can still conflict when they edit adjacent uses: lines in the same workflow file (.github/workflows/main.yml holds most pins), so merge sequentially and @dependabot rebase the next PR after each squash merge.

Operating modes

Mode	Actions	Merge
Audit	List/classify; publisher + bump type	No
Validate	Diff review; CI green; actionlint	No
Full	Validate + merge with consent	Per PR

Default to Audit unless the user asks to merge.

Phase 0 — Tool bootstrap

command -v gh >/dev/null && gh auth status
# Optional local workflow lint (CI already runs actionlint in the `lint` job):
#   bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)

Phase 1 — Discovery

From repository root:

gh pr list --author 'app/dependabot' --state open \
  --json number,title,headRefName,headRefOid,mergeable,statusCheckRollup \
  --jq '.[] | select(.headRefName | test("^dependabot/github_actions/"))'

Match on headRefName, not the title. Titles such as "bump goreleaser-action" or "bump golangci-lint-action" trip the gomod skill's word filter but belong here. Confirm the diff only touches .github/workflows/ (gh pr diff <n> --name-only).

Phase 2 — Risk

Level	Examples	Action
Low	Patch/minor bump, first-party publisher (`actions/`, `docker/`, `golangci/`, `goreleaser/`)	Merge after CI
Medium	Major bump (`v4` to `v5`); action used only in release/publish jobs	Read changelog; check inputs
High	New/untrusted publisher; SHA and `# vX` comment disagree; non-SHA (tag or branch) pin	Hold; manual review

Trusted publishers already in .github/workflows/ carry low supply-chain risk. A major bump can change or remove with: inputs, so read the release notes and confirm the workflow still passes the right inputs.

Release-only caveat: PR CI runs the jobs triggered by the pull_request event (lint, test-nix, test-windows-smoke). Steps and jobs gated to releases or tags (goreleaser, docker/login, publish, binaries-*) are skipped on the PR, so green CI does not exercise them. For those, lean on the changelog and trusted-publisher status.

Phase 3 — Validate

Required checks green on the current head (gh pr checks <n>). The lint job runs actionlint over the workflow files.
SHA/tag consistency: the new # vX comment matches the tag for the bumped SHA.
Optional local lint after installing actionlint: ./actionlint -color.
Stale-head guard: after any @dependabot rebase, re-check that the required checks passed on the new headRefOid before merging.

Phase 4 — Merge (consent-gated)

After required checks pass on the current head:

gh pr merge <n> --squash --delete-branch

Multiple action PRs: merge one, then @dependabot rebase the next and wait for mergeable plus fresh CI before merging it. Use --admin only when the user explicitly requests it and checks are green but merge is blocked.

Verdict template

## Dependabot github-actions PR #NNN — <action>

- **Publisher / bump:** first-party? patch | minor | major
- **Runs on PR CI:** yes | release-only (not exercised)
- **CI (lint/actionlint, test-nix):** pass / fail
- **SHA vs tag comment:** consistent?
- **Verdict:** merge | hold

See AGENTS.md and docs/WORKFLOW.md for the CI job map.