Updating GitHub Actions Along with Your Packages Using pnpm update

In GitHub Actions workflows, you specify the version of an Action with the uses key, as shown below. For security reasons, pinning to a full commit SHA rather than a tag is recommended.

steps:
  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
  - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0

When a bug fix or security fix lands after an Action's release, you need to update the version written in your workflow as well. It would be convenient to manage dependencies in a single place, the way package.json and pnpm-lock.yaml do, but GitHub Actions versions are written directly into YAML files, which tends to make updating them tedious.

The --include-github-actions option, added in pnpm 11.16.0, lets you update your packages and your GitHub Actions dependencies with the same command. Updated Actions are pinned to a full commit SHA, with the corresponding release tag preserved as a comment.

This article walks through the basics of pnpm update --include-github-actions.

Trying out --include-github-actions

Let's use the following workflow to see how it behaves. It specifies actions/[email protected] and actions/[email protected], both older than the latest versions available at the time of writing.

name: CI
 
on:
  push:
 
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/[email protected]
      - uses: actions/[email protected]
        with:
          node-version: 24
      - run: npm test

Running pnpm update without any options leaves the workflow untouched.

pnpm update

To include GitHub Actions in the update, pass --include-github-actions.

pnpm update --include-github-actions

Running the command changed the workflow as follows.

     steps:
-      - uses: actions/[email protected]
-      - uses: actions/[email protected]
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24

The tags in uses have been replaced with 40-character commit SHAs, and the release tags have been added as comments. pnpm runs git ls-remote against the referenced repository to retrieve the mapping between tags and commits, then picks a stable release as the update target.

Use --latest to update major versions

Just as a regular pnpm update respects the version ranges in package.json, --include-github-actions on its own will not bump an Action across major versions. At the time of writing, the v7 line had already been released, yet v4.4.0—the latest release in the v4 line—was chosen.

To update to the latest stable version including major version bumps, combine it with --latest.

pnpm update --latest --include-github-actions

Running that command produced the following versions.

     steps:
-      - uses: actions/[email protected]
-      - uses: actions/[email protected]
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24

Major version updates may include breaking changes, so make sure to verify that your workflow still works afterward.

Checking update candidates without changing files

If you want to review the candidates before modifying any files, you can pass --include-github-actions to pnpm outdated as well.

pnpm outdated --include-github-actions

Running it against the workflow produced the following output.

┌────────────────────────────────────┬──────────────────────┬────────┐
│ Package                            │ Current              │ Latest │
├────────────────────────────────────┼──────────────────────┼────────┤
│ actions/checkout (github action)   │ 4.0.0 (wanted 4.4.0) │ 7.0.1  │
├────────────────────────────────────┼──────────────────────┼────────┤
│ actions/setup-node (github action) │ 4.0.0 (wanted 4.4.0) │ 7.0.0  │
└────────────────────────────────────┴──────────────────────┴────────┘

The Current column shows the release currently in use, along with the release available within the current major version (wanted) in parentheses. Latest is the newest stable version regardless of major version. Reviewing this output helps you decide whether to run a regular update or use --latest.

Enabling it permanently in a configuration file

If you would rather not pass the option every time and always want GitHub Actions checked, set update.githubActions to true in pnpm-workspace.yaml.

update:
  githubActions: true

With this setting in place, plain pnpm update and pnpm outdated will include GitHub Actions as well.

If your Actions are hosted on a GitHub Enterprise Server, pnpm 11.17.0 and later let you specify the server URL via update.githubActionsServer.

update:
  githubActions: true
  githubActionsServer: "https://github.example.com"

If the GITHUB_SERVER_URL environment variable is set, its value is used as well. When neither is present, pnpm connects to https://github.com.

Summary

• pnpm update --include-github-actions updates the GitHub Actions referenced by your workflows in addition to your packages
• Updated Actions are pinned to a commit SHA, with the corresponding release tag preserved as a comment
• --include-github-actions alone updates within the current major version; combining it with --latest updates to the latest major version
• pnpm outdated --include-github-actions lets you compare the current version, the version available within the current major version, and the latest version without changing any files
• Setting update.githubActions: true makes pnpm update and pnpm outdated always check GitHub Actions

References

• pnpm update
• pnpm outdated
• Updating GitHub Actions - pnpm
• pnpm 11.16
• pnpm 11.17
• GitHub Actions - Secure use reference