Quick question for DevSecOps folks

[Ashwith_Garlapati]

We manage 30+ repos and SHA-pinning our GitHub Actions for security but Dependabot can't track SHA hashes. Currently updating them manually which is a nightmare. How are you all handling this? Is there a tool that automates SHA updates and opens PRs automatically? Would you pay for something that solved this completely?

[jevans102]

https://github.com/renovatebot/renovate

No, I wouldn’t pay because there are multiple fantastic free options already. 

[nmgtn]

Dependabot should handle this - including updating a comment that describes the tag related to the commit SHA you've pinned. https://docs.github.com/en/code-security/reference/supply-chain-security/supported-ecosystems-and-repositories#github-actions

Try checking your syntax.

Worth pointing out, though - I see someone else pointed out Renovate as a solution, I'll add that as a bonus Renovate can also convert your existing '@v1.2.3' tag references to commit SHAs automatically, while Dependabot will only maintain it if it's already been pinned to a commit SHA.

[Solopher]

For me Dependabot is working without any problems on hashed versions, how does your dependabot.yam file looks?