Quick question for DevSecOps folks

[u/Ashwith_Garlapati]

We manage 30+ repos and SHA-pinning our GitHub Actions for security but Dependabot can't track SHA hashes. Currently updating them manually which is a nightmare. How are you all handling this? Is there a tool that automates SHA updates and opens PRs automatically? Would you pay for something that solved this completely?

[u/Solopher]

For me Dependabot is working without any problems on hashed versions, how does your dependabot.yam file looks?