Automated dependency updates cover both application dependencies and CI dependencies
Pinning actions to SHAs (R-SEC-01) freezes them until something unfreezes them. Without an updater, pinned means unpatched.
Observable check
the repository contains .github/dependabot.yml or a Renovate configuration, and its ecosystem list covers both the package manager the project uses and the CI action or container images it runs.
Where this comes from
- https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
- https://github.com/ossf/scorecard/blob/main/docs/checks.md
Last read against these sources on 2026-07-28.
Confirms the github-actions ecosystem covering .github/workflows, and that bun is a supported ecosystem. Scorecard Dependency-Update-Tool accepts Dependabot or Renovate.