actions/dependabot

Dependabot Action

Update GitHub Actions versions across organization repos with cached version resolution. Provides centralized, org-wide updates (including private/internal repos) without per-repo Dependabot configuration.

Usage

name: Dependabot
on:
  workflow_dispatch:
  schedule:
    - cron: "0 5 * * 1" # weekly on Monday at 05:00 UTC

jobs:
  dependabot:
    runs-on: ubuntu-latest
    steps:
      - uses: ultralytics/actions/dependabot@main
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

Inputs

Input	Description	Required	Default
token	GitHub token with contents:write, pull-requests:write, and workflow scopes	Yes	-
org	GitHub organization name	No	ultralytics
public	Scan public repositories	No	true
private	Scan private repositories	No	true
internal	Scan internal repositories	No	true

How It Works

1. Lists all active repos in the org (filtered by visibility)
2. Fetches GitHub Actions files (.github/workflows/*.yml/*.yaml and action.yml/action.yaml) from each repo
3. Parses uses: lines and resolves the latest release for each action
4. Creates one PR per outdated action per repo, updating all files that reference it
5. Skips PRs that already exist (matches by title)

Version Handling

Format	Example	Behavior
Branch	@main	Skipped
Major tag	@v7	Updated to @v8 only if the upstream v8 tag exists
Specific tag	@v2.8.0	Updated to a newer release tag
SHA pinned	@abc123... # v7.0.0	SHA + comment updated to latest

Caching

Action versions are resolved once and reused across all repos. For an org with 60 repos using 15 common actions, this saves ~885 API calls per run.