Support bumping uses: docker://… in GitHub Actions workflows

[l0b0]

Is there an existing issue for this?

• I have searched the existing issues

Feature description

To reproduce

1. Create a new Git repo

2. Create .github/workflows/main.yml containing

   on: [push]
   jobs:
     main:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
         - name: Check workflow files
           uses: docker://rhysd/actionlint:1.6.25@sha256:86ebdb1c0df5a8be92b9d53e2e0c636978a2b3c6e52c86c65a77e2c78a6bd594
   

3. Create .github/dependabot.yml containing

   version: 2
   updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: daily
   

4. Push to GitHub

5. Run Dependabot

What happens: No PRs are created

What should happen: Dependabot should create a PR changing uses: docker://rhysd/actionlint:1.6.25@sha256:86ebdb1c0df5a8be92b9d53e2e0c636978a2b3c6e52c86c65a77e2c78a6bd594 to uses: docker://rhysd/actionlint:1.6.26@sha256:2eb91a78b5a19140be099c7b4262d298c2567f2a9f27e10ed2a4323c5bcface8.

Other info

This seems to be a known problem based on this 4-year-old comment, but I couldn't find an associated issue.

Workaround

1. Create a new Dockerfile, such as .github/workflows/actionlint.dockerfile, with just a FROM … line containing everything after uses: docker:// from the original workflow. For the example above, FROM rhysd/actionlint:1.6.25@sha256:86ebdb1c0df5a8be92b9d53e2e0c636978a2b3c6e52c86c65a77e2c78a6bd594.
2. "Build" (just downloads) the image in the GitHub action using something like run: docker build --tag actionlint - < .github/workflows/actionlint.dockerfile
3. Run the resulting image, for example like run: docker run --volume="${PWD}:/repo" --workdir=/repo actionlint.
4. Configure package-ecosystem: "docker" with directory: "/.github/workflows".
5. Push
6. Verify that Dependabot creates a PR to change the Dockerfile to FROM rhysd/actionlint:1.6.26@sha256:2362769b1d75056da70e7af1b12d9e52746f3a123b8f22a4322869e8f2cd45f2

[martincostello]

+1 for adding support for this. All the LEGO pieces to do it exist in the repo, they're just spread across the Actions and Docker updaters and don't overlap.

Until this is a native feature, I've written a GitHub Actions workflow that does this on a schedule using the same regclient tool that the Docker updater uses.

[thomasleplus]

That would be a great feature indeed.