feat: add github-actions tag support

lib/manager/github-actions/__fixtures__/workflow.yml.2

@@ -0,0 +1,20 @@
+name: Run linters
+
+on: [push]
+
+jobs:
+  shell_lint:
+    name: Shell lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Shell lint
+        uses: actions/bin/[email protected]
+        run: ./entrypoint.sh
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+      - name: Build
+        uses: actions/docker/cli@master
+        run: build -t conventional-commits .

lib/manager/github-actions/__snapshots__/extract.spec.ts.snap

@@ -1,5 +1,44 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
+exports[`lib/manager/github-actions/extract extractPackageFile() extracts multiple action tag lines from yaml configuration file 1`] = `
+Array [
+  Object {
+    "currentValue": "v1.0.0",
+    "datasource": "github-tags",
+    "depName": "actions/bin/shellcheck",
+  },
+  Object {
+    "currentValue": "1.0.0",
+    "datasource": "github-tags",
+    "depName": "actions/checkout",
+  },
+]
+`;
+
+exports[`lib/manager/github-actions/extract extractPackageFile() extracts multiple docker image lines from yaml configuration file 1`] = `
+Array [
+  Object {
+    "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
+    "currentDigest": undefined,
+    "currentValue": undefined,
+    "datasource": "docker",
+    "depName": "replicated/dockerfilelint",
+    "replaceString": "replicated/dockerfilelint",
+    "versioning": "docker",
+  },
+  Object {
+    "autoReplaceStringTemplate": "{{depName}}{{#if newValue}}:{{newValue}}{{/if}}{{#if newDigest}}@{{newDigest}}{{/if}}",
+    "commitMessageTopic": "Node.js",
+    "currentDigest": "sha256:7b65413af120ec5328077775022c78101f103258a1876ec2f83890bce416e896",
+    "currentValue": "6",
+    "datasource": "docker",
+    "depName": "node",
+    "replaceString": "node:6@sha256:7b65413af120ec5328077775022c78101f103258a1876ec2f83890bce416e896",
+    "versioning": "docker",
+  },
+]
+`;
+
 exports[`lib/manager/github-actions/extract extractPackageFile() extracts multiple image lines from docker_container 1`] = `
 Array [
   Object {

lib/manager/github-actions/extract.spec.ts

@@ -2,12 +2,12 @@ import { readFileSync } from 'fs';
 import { extractPackageFile } from './extract';
 
 const workflow1 = readFileSync(
-  'lib/manager/github-actions/__fixtures__/main.workflow.1',
+  'lib/manager/github-actions/__fixtures__/workflow.yml.1',
   'utf8'
 );
 
 const workflow2 = readFileSync(
-  'lib/manager/github-actions/__fixtures__/workflow.yml.1',
+  'lib/manager/github-actions/__fixtures__/workflow.yml.2',
   'utf8'
 );
 
@@ -16,12 +16,12 @@ describe('lib/manager/github-actions/extract', () => {
     it('returns null for empty', () => {
       expect(extractPackageFile('nothing here')).toBeNull();
     });
-    it('extracts multiple image lines from docker_container', () => {
+    it('extracts multiple docker image lines from yaml configuration file', () => {
       const res = extractPackageFile(workflow1);
       expect(res.deps).toMatchSnapshot();
       expect(res.deps).toHaveLength(2);
     });
-    it('extracts multiple image lines from yaml configuration file', () => {
+    it('extracts multiple action tag lines from yaml configuration file', () => {
       const res = extractPackageFile(workflow2);
       expect(res.deps).toMatchSnapshot();
       expect(res.deps).toHaveLength(2);

lib/manager/github-actions/extract.ts

@@ -1,30 +1,50 @@
+import * as githubTagsDatasource from '../../datasource/github-tags';
 import { logger } from '../../logger';
 import * as dockerVersioning from '../../versioning/docker';
+import * as semverVersioning from '../../versioning/semver';
 import { PackageDependency, PackageFile } from '../common';
 import { getDep } from '../dockerfile/extract';
 
 export function extractPackageFile(content: string): PackageFile | null {
   logger.debug('github-actions.extractPackageFile()');
   const deps: PackageDependency[] = [];
   for (const line of content.split('\n')) {
-    // old github actions syntax will be deprecated on September 30, 2019
-    // after that, the first line can be removed
-    const match =
-      /^\s+uses = "docker:\/\/([^"]+)"\s*$/.exec(line) ||
-      /^\s+uses: docker:\/\/([^"]+)\s*$/.exec(line);
-    if (match) {
-      const [, currentFrom] = match;
+    if (line.trim().startsWith('#')) {
+      continue; // eslint-disable-line no-continue
+    }
+
+    const dockerMatch = /^\s+uses: docker:\/\/([^"]+)\s*$/.exec(line);
+    if (dockerMatch) {
+      const [, currentFrom] = dockerMatch;
       const dep = getDep(currentFrom);
       logger.debug(
         {
           depName: dep.depName,
           currentValue: dep.currentValue,
           currentDigest: dep.currentDigest,
         },
-        'Docker image inside GitHub Actions'
+        'Docker image inside GitHub Workflow'
       );
       dep.versioning = dockerVersioning.id;
       deps.push(dep);
+      continue; // eslint-disable-line no-continue
+    }
+
+    const tagMatch = /^\s+-?\s+?uses: (?<depName>[a-z-/]+?)@(?<currentValue>.+?)\s*?$/.exec(
+      line
+    );
+    if (tagMatch) {
+      const { depName, currentValue } = tagMatch.groups;
+      // Only allow tagged versions for now
+      if (semverVersioning.isVersion(currentValue)) {
+        const dep = {
+          depName,
+          currentValue,
+          datasource: githubTagsDatasource.id,
+        };
+        logger.debug(dep, 'GitHub Action inside GitHub Workflow');
+        deps.push(dep);
+      }
     }
   }
   if (!deps.length) {