When Dependabot opens a pull request to update third-party action versions, the PR will always need manual intervention because the template file is not updated and the next run of update.php erases the changes to the .github/workflows directory.
Dependabot does support specifying multiple directories, but it's unclear whether
- a file with invalid YAML (which the template is considered) would be updated correctly.
- a file outside of the
.github folder would be updated
If the file must be valid YAML, then the tokens could be changed to be within comments. If the file needs to be inside .github/, perhaps the template could be moved.
When Dependabot opens a pull request to update third-party action versions, the PR will always need manual intervention because the template file is not updated and the next run of
update.phperases the changes to the.github/workflowsdirectory.Dependabot does support specifying multiple
directories, but it's unclear whether.githubfolder would be updatedIf the file must be valid YAML, then the tokens could be changed to be within comments. If the file needs to be inside
.github/, perhaps the template could be moved.