pkl.github.dependabotManagedActions.DependabotManagedActions1.1.5

Typically, this module is placed in .github/index.pkl. To produce output, the -m (or --multiple-file-output-path) flag must pointed at the repo's .github directory.

In addition to the regular workflows, this template also produces a fake workflow called __lockfile__.yml. The contents of this lockfile are used to replace the uses of versioned actions with their git SHA. For example, uses: checkout@v6 becomes uses: checkout@abc123 # v6. If the lockfile doesn't already exist, or if a new action is used, action versions are resolved to their SHA and the lockfile is updated as a result of evaluation.

Additionally, this template produces a dependabot.yml file, which configures GitHub to automatically update the workflow YAMLs with updated git shas as new action versions are released.

Example

Here is an example of this template in use, along with the corresponding PklProject. In addition to these two files, the project must be resolved with pkl project resolve .github/, which will create .github/PklProject.deps.json to also be checked into the repo.

To render this into YAML, run pkl eval --project-dir .github .github/index.pkl.

// .github/index.pkl
amends "@pkl.github.dependabotManagedActions/DependabotManagedActions.pkl"

import "@com.github.actions/catalog.pkl"

workflows {
  ["workflows/build.yml"] {
    jobs {
      ["do-build"] {
        catalog.`actions/checkout@v6`
        catalog.`actions/setup-go@v5`
        new {
          run = "go test ./..."
        }
      }
    }
  }
}

// .github/PklProject
amends "pkl:Project"

dependencies {
  ["com.github.actions"] {
    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.3.0"
  }
  ["pkl.github.dependabotManagedActions"] {
    uri = "package://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.0.0"
  }
}