There’s also a problem, which I wanted to describe in its own comment. Namely, we have a set of small actions:
- GitHub - ansible-community/github-action-run-nox: Convenience GitHub Action to run nox, to be combined with the wntrblm/nox action · GitHub
GitHub - ansible-community/github-action-test-galaxy-import: GitHub Action for testing Galaxy import of an Ansible collection · GitHub(going to be archived)GitHub - ansible-community/github-action-build-collection: GitHub Action for building Ansible collections · GitHub(going to be archived)
that don’t have proper releases (we use them from their v1 or simply main branch), and for these pinning doesn’t work well, since Dependabot won’t update the pin since there are no releases. (At least to my knowledge, but maybe I’m wrong?)
As far as I know, the only way to be able to pin these would be to regularly create releases. But creating releases means more effort, also since now there will be more frequent updates (due to pinned versions of their dependencies; so far bumps only happened when actions released new major versions, now also for minor and bugfix releases), and thus we should also release these actions and shared workflows more frequently. This creates some extra work (and policy decisions, like how often should these be released?).
What do people think about this?