Dependabot covers gomod but not github-actions

[korya]

Problem

.github/dependabot.yml watches Go modules and nothing else:

updates:
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "weekly"

The workflow's own actions are unmanaged, so they age silently:

Action	Pinned at
actions/checkout	v4
actions/setup-go	v5
extractions/setup-just	v3
golangci/golangci-lint-action	v8

Why it matters

• Silent staleness. Major-version tags stop receiving fixes once the next major ships, and nothing in the repo signals it. The Go dependencies get weekly attention while the pipeline that validates them does not.
• Deprecation lands as a broken build. GitHub retires runtimes (the Node 16 → 20 transition being the recent example) by warning first and failing later. Without dependabot the first signal is a red CI run on an unrelated PR.
• Security advisories are missed. Actions execute with repo-write-capable tokens; an advisory against one is exactly what dependabot exists to surface.
• Uneven with existing practice. The commit log shows dependabot Go bumps being merged routinely, so the mechanism is trusted here — it's just pointed at half the surface.

Suggested fix

version: 2
updates:
  - package-ecosystem: "gomod"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Note directory: "/" is correct for the actions ecosystem even though the files live in .github/workflows/ — dependabot resolves that path itself.

Also worth pinning (separate concern, same theme)

Two tools are installed unpinned and are therefore not covered by dependabot at all, because they aren't declared as dependencies anywhere:

- uses: golangci/golangci-lint-action@v8
  with:
    version: latest              # build.yml
- run: go install github.com/securego/gosec/v2/cmd/gosec@latest

lint:     golangci-lint run ./...     # Justfile
security: gosec ./...

This already caused a live breakage: gosec 2.28.0 introduced rule G704 and turned just pre-commit red on an unchanged tree (fixed in #49). Pinning both to explicit versions — in the workflow and in the Justfile, so local and CI agree — converts "CI broke overnight" into a reviewable dependabot PR.

Related

• Suppress the gosec G704 SSRF false positive in Client.Do #49 — the G704 breakage this would have caught as a PR instead of a red build

[korya]

Half of this landed in 3b66625 (#63); the half that caused the actual breakage did not.

Done: the Dependabot ecosystem

.github/dependabot.yml now watches github-actions, and it went to work immediately — four bumps opened within hours, three already merged:

Action
actions/checkout	v4 → v7 (#65)
extractions/setup-just	v3 → v4 (#64)
golangci/golangci-lint-action	v8 → v9 (#66)
actions/setup-go	5 → 7 (#67, open)

Three majors behind on checkout is precisely the silent staleness this issue predicted.

Still open: the unpinned tools

The "also worth pinning" section is untouched, and it is the part with a live incident behind it:

- uses: golangci/golangci-lint-action@v9
  with:
    version: latest                                          # build.yml:30
- run: go install github.com/securego/gosec/v2/cmd/gosec@latest   # build.yml:33

lint:     golangci-lint run ./...   # Justfile -- whatever is on PATH
security: gosec ./...

Dependabot cannot reach either, because neither is declared as a dependency anywhere. This is the mechanism behind #49: gosec 2.28.0 shipped rule G704 and turned just pre-commit red on an unchanged tree.

New since this issue was filed: golangci-lint-action is now v9 and still resolves version: latest, so the linter can move underneath the repo from two directions at once.

Retitling territory — the remaining scope is pinning golangci-lint and gosec to explicit versions in both the workflow and the Justfile, so local and CI agree and an upgrade arrives as a reviewable PR rather than a red build.