Zig Dependabot Action

Automated dependency updates for Zig projects.

Usage

Inputs

Contributing

This action automatically keeps your Zig dependencies up-to-date by scanning your build.zig.zon, checking for newer versions of your git-based dependencies (GitHub, GitLab, Codeberg, etc.), and managing the update process via Pull Requests or Issues.

Usage

Create a workflow file .github/workflows/zig-dependabot.yml.

Minimal Configuration

name: Zig Dependabot

on:
  schedule:
    - cron: '0 0 * * *' # Run daily at midnight
  workflow_dispatch: # Allow manual trigger

permissions:
  contents: write # Required to push update branches
  pull-requests: write # Required to create and manage PRs
  issues: write # Required if you enabled issue creation

jobs:
  update-deps:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Zig
        uses: mlugg/setup-zig@v2
        with:
          version: master

      - name: Run Zig Dependabot
        uses: muhammad-fiaz/zig-dependabot@v1
        with:
          token: ${{ secrets.GH_TOKEN }}
          # Optional: Add extra trusted domains
          extra_domains: 'git.sr.ht, my-gitea.com'
          create_pr: true # default true
          # Optional: create issue along with PR
          create_issue: false
          # Optional: Reopen closed PRs/Issues
          reopen: false
          # Optional: Close outdated PRs/Issues
          close_old: false

Inputs

Input	Description	Default
token	GitHub Token used for API access.	${{ github.token }}
extra_domains	Comma-separated list of additional trusted git domains (e.g. git.sr.ht). By default, github.com, gitlab.com, bitbucket.org, and codeberg.org are trusted.	""
create_pr	Whether to create a Pull Request for updates.	true
create_issue	Whether to create an Issue for updates instead of/in addition to PRs.	false
reopen	Whether to reopen closed PRs/Issues if they exist.	false
close_old	Whether to close outdated PRs and Issues.	false

Required Permissions

This action requires the following permissions to function correctly:

• contents: write: To create new branches and push commits with dependency updates.
• pull-requests: write: To create new Pull Requests and close outdated ones.
• issues: write: To create issues (if create_issue is enabled).

If you are using a restrictive token or Fine-grained PAT, ensure it has these scopes for the repository.

CI Validation

Since zig-dependabot runs purely to update dependencies, it does not run your tests locally to save time and resources. It is highly recommended to have a separate CI workflow (e.g., on: pull_request) that runs zig build and zig build test to validate the PRs created by this action.