When hash-pinning GitHub Actions, Dependabot updated an Action's version comment in one file but not another

[pnacht]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

github-actions

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "github-actions" # See documentation for possible values
    directory: "/" # Location of package manifests
    schedule:
      interval: "weekly"

Updated dependency

No response

What you expected to see, versus what you actually saw

We received a single PR updating actions/checkout in two files:

scorecard.yml is correctly updated, both the hash and the version comment:

    steps:
      - name: "Checkout code"
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

However, for testing.yml only the hash is updated:

    steps:
-      - uses: actions/checkout@83b7061638ee4956cf7545a6f7efe594e5ad0247 # v3.5.1
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.1

If relevant, the hash for v3.5.1 was manually obtained by going to the actions/checkout Releases page.

I'd have expected testing.yml to also change the version comment to v3.5.2.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

nebraska-dev/dependabot-debug#5

Smallest manifest that reproduces the issue

The repo linked above is pretty close to an MRE, but the following should (not) work as well:

dependabot.yml:

version: 2
updates:
  - package-ecosystem: "github-actions" # See documentation for possible values
    directory: "/" # Location of package manifests
    schedule:
      interval: "weekly"

testing.yml:

on:
  push:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@83b7061638ee4956cf7545a6f7efe594e5ad0247 # v3.5.1

[na-jakobs]

Dependabot does not seem to update the version comment at all in my case. This is a regression.

- name: Login to GitHub Container Registry
  uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2
  uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2

[pnacht]

That particular case actually seems to be working as intended.

v2 is a major version tag which is kept up-to-date with the latest release. So it used to point to v2.1.0, but now it points to v2.2.0.

If you change the comment to # v2.2.0, then you should expect to see it updated to # v2.3.0 (or whatever the new version may be) on the next release.

[deivid-rodriguez]

This was also fixed by #8068 and #8098 🎉. Let me know if you still see issues though!