From d534552d685ec2113b7bb8e1caa893ddce6ec219 Mon Sep 17 00:00:00 2001
From: prql-bot <107324867+prql-bot@users.noreply.github.com>
Date: Mon, 10 Aug 2026 08:27:20 +0000
Subject: [PATCH] ci: let Dependabot scan the tend-setup and build-js composite
 actions

---
 .github/actions/tend-setup/action.yaml | 2 +-
 .github/dependabot.yaml                | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/actions/tend-setup/action.yaml b/.github/actions/tend-setup/action.yaml
index 52dd9637ef60..13d8aec47d53 100644
--- a/.github/actions/tend-setup/action.yaml
+++ b/.github/actions/tend-setup/action.yaml
@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Setup Task
-      uses: go-task/setup-task@v1
+      uses: go-task/setup-task@v2
       with:
         repo-token: ${{ inputs.github-token }}
         version: 3.52.0
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index c7f8a6b4a72a..0b05d7aadf79 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -39,11 +39,16 @@ updates:
     labels: []
 
   - package-ecosystem: "github-actions"
+    # `/` only covers `.github/workflows/`; each composite action under
+    # `.github/actions/` needs its own entry or its `uses:` refs are never
+    # scanned. Keep this list in sync with `ls .github/actions/`.
     directories:
       - "/"
-      - ".github/actions/build-python"
+      - ".github/actions/build-js"
       - ".github/actions/build-prqlc"
       - ".github/actions/build-prqlc-c"
+      - ".github/actions/build-python"
+      - ".github/actions/tend-setup"
       - ".github/actions/time-compilation"
     commit-message:
       prefix: "chore: "