[rethab]

> scheduled GitHub Action workflow

..sounds like they're not dogfooding dependabot? curious if anybody knows more/why

[djm_]

Dependabot is based on releases from the various package repositories; running of main is pre-release - hence they’re probably using GitHub Actions to pin their Gemfile-defined Rails version to a commit hash.

[heartbreak]

Dependabot is for security issues, not this?

[rethab]

dependabot can also be used for regular version updates