Document that Dependabot supports updates by commit and commit+tag/release

[yeikel]

Why:

Closes: #41346

What's being changed (if available, include any code snippets, screenshots, or gifs):

Updates the Dependabot documentation to reflect the support for GitHub Actions including

• Update by commit (not just by tag)
• Update the tag/release documentation if provided

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
actions/reference/security/secure-use.md	fpt ghec ghes@ 3.18 3.17 3.16 3.15 3.14	fpt ghec ghes@ 3.18 3.17 3.16 3.15 3.14	from reusable

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[yeikel]

@Sharra-writes I am not sure if there is any reusable that captures actions/checkout@<commit> like we have one for reusables.actions.action-checkout %}. If we do, I'd be happy to update it

Thanks!

[Andrej730]

Hi! Thanks for looking into this. There's one more thing it seems to support - if provided hash doesn't have any tag, than dependabot will update it to the latest commit (not the latest release!).

example

From 5651640dc72edabe1a0dc575019d2178acb1b10d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 19 Nov 2025 10:05:31 +0000
Subject: [PATCH] Bump hendrikmuhs/ccache-action in the all-actions group

Bumps the all-actions group with 1 update: [hendrikmuhs/ccache-action](https://github.com/hendrikmuhs/ccache-action).


Updates `hendrikmuhs/ccache-action` from 15457da8f7bbf9b2c71f2efebd847c1a84650208 to 5ebbd400eff9e74630f759d94ddd7b6c26299639
- [Release notes](https://github.com/hendrikmuhs/ccache-action/releases)
- [Commits](https://github.com/hendrikmuhs/ccache-action/compare/15457da8f7bbf9b2c71f2efebd847c1a84650208...5ebbd400eff9e74630f759d94ddd7b6c26299639)

---
updated-dependencies:
- dependency-name: hendrikmuhs/ccache-action
  dependency-version: 5ebbd400eff9e74630f759d94ddd7b6c26299639
  dependency-type: direct:production
  dependency-group: all-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
---
 .github/workflows/build-heavy-compile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-heavy-compile.yml b/.github/workflows/build-heavy-compile.yml
index dfba755..c77cd5b 100644
--- a/.github/workflows/build-heavy-compile.yml
+++ b/.github/workflows/build-heavy-compile.yml
@@ -9,7 +9,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: hendrikmuhs/ccache-action@15457da8f7bbf9b2c71f2efebd847c1a84650208
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639
 
     - name: Configure build
       run: |

[yeikel]

Hi! Thanks for looking into this. There's one more thing it seems to support - if provided hash doesn't have any tag, than dependabot will update it to the latest commit (not the latest release!).

Thanks for pointing this out. I updated it with this edge case

[Sharra-writes]

@yeikel Thanks for opening the PR for this! I've contacted the Dependabot team and we'll get their opinion.

[jeffwidman]

Nice fixup @yeikel 😍

[Sharra-writes]

@yeikel This repo is on a deploy freeze for US Thanksgiving because most of the senior level docs team is out for the holiday, but I will mark this as ready to be merged so we can get it done next week.