dependabot / fetch-metadata

Extract information about the dependencies being updated by a Dependabot-generated PR.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Allow to use latest v1

MichaIng opened this issue · comments

Currently, unlike with other GitHub actions, it is not possible to use the latest v1 via:

uses: dependabot/fetch-metadata@v1

=>

Error: Unable to resolve action `dependabot/fetch-metadata@v1`, unable to find version `v1`

It would be great it that was possible, so one does not need to (or gets offered to) update the workflow on every patch or minor version, where maintained compatibility is at least expected. Similarly dependabot/fetch-metadata@v1.3 would be nice to work for a more conservative approach, pulling the latest patch version only.

I know this works with the official GitHub Actions actions, like actions/checkout@v3. They create and update additional release tags for this: https://github.com/actions/checkout/tags

Hi @MichaIng thanks for this feedback, that's oversight on our part. I've added a v1 tag and I'll update our release process to ensure it is moved forward.

That is great, many thanks!

Have you thought about subversion tags as well, i.e. v1.3 pointing to v1.3.0 and to v1.3.1 once released? Probably not so important, but if it doesn't add much efforts to the release process it would make it complete by allowing to run with the latest patch version as well 🙂.

Currently it points to v1.3.0 while it should point to v1.3.0, btw.

Right, v1.3.1 you mean 😉. I hope it doesn't cause too much additional hassle to keep the v1 tag updated, probably as part of a release workflow 🙂.

Ideally it should be automated :)