Best practices for managing Github actions + workflows in an organization?

Question

In my organization, we have more than a hundred repos, most of them use their own workflows but also reusable workflows that are located in a designated repo, that also holds all of our self made composite actions.

The thing is, it is getting hard to manage, since if a repo's workflow uses let's say the checkout action, if I want to bump it's version of the action, I need to go through all of the repos in the org, change the version, test it and so on.

adding dependabot to each repo is also tedious, is there no way really to add a dependabot.yml file that will watch over my entire organization? or other similar tools?

What are my options for making management and maintenance of my org easier, safer, and more reliable overall? I'm looking for a "design pattern" if you will.

Answer 1

You can simply sync your workflows from one source repository to many.

Here is an example:

name: Synchronize Workflows Files
on:
  workflow_dispatch:

jobs:
  sync:
    name: Synchronize Files
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@master

      - name: Run GitHub File Sync
        uses: BetaHuhn/repo-file-sync-action@v1
        with:
          CONFIG_PATH: .github/sync-workflows.yaml
          GH_PAT: ${{ secrets.YOUR_PAT }}
          SKIP_PR: true

Then you just have to create your CONFIG_PATH 'sync-workflows.yaml' file:

group:
  - files:
      - source: '.github/ci-actions/node-back/'
        dest: '.github/workflows'
    repos: |
      your-org/node-backend-repo@master
      your-org/node-backend-repo@develop

When you run the first workflow, it send all workflows in '.github/ci-actions/node-back/' to the '.github/workflows' directory of 'your-org/node-backend-repo' on both 'master' and 'develop' branches.

NOTE: Your PAT need write access to each repo you want to sync.