Skip to content

Commit 11bbe78

Browse files
authored
Add known case with monorepos
For monorepos, tag separated tags don't work with dependabot. Instead, slash separated tags are needed
1 parent 5e4a63e commit 11bbe78

File tree

1 file changed

+21
-0
lines changed

1 file changed

+21
-0
lines changed

content/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,24 @@ You can configure updates for repositories that contain a dependency manifest or
4444
If your repository already uses an integration for dependency management, you will need to disable this before enabling {% data variables.product.prodname_dependabot %}. {% ifversion fpt or ghec %}For more information, see [AUTOTITLE](/get-started/exploring-integrations/about-integrations).{% endif %}
4545

4646
{% data reusables.dependabot.supported-package-managers %}
47+
48+
### Known issue: Tag format for GitHub Actions in monorepos
49+
50+
If your repository contains multiple GitHub Actions (for example, in a monorepo), the tag format you use affects how {% data variables.product.prodname_dependabot %} detects and updates action versions.
51+
52+
- **Dash (-) separator (e.g. my-action-v0.1.0):**
53+
- Dependabot may incorrectly update multiple actions or fail to detect new versions.
54+
- **Slash (`/`) separator (e.g., `my-action/v0.1.0`):**
55+
- Dependabot correctly detects and updates each action independently
56+
57+
**Example**:
58+
```yaml
59+
# Recommended: namespaced with slash
60+
uses: my-org/my-action-a/v0.1.0
61+
62+
# Not recommended: dash
63+
uses: my-org/my-action-a-v0.1.0
64+
```
65+
66+
**Recommendation:**
67+
For monorepos with multiple actions, use the `name/version` (slash) format for action tags to ensure accurate {% data variables.product.prodname_dependabot %} updates.

0 commit comments

Comments
 (0)