feat(github-actions): add some community action support

lib/modules/manager/github-actions/extract.spec.ts

@@ -1,5 +1,6 @@
 import { codeBlock } from 'common-tags';
 import { GlobalConfig } from '../../../config/global';
+import { dump } from '../../../util/yaml';
 import { extractPackageFile } from '.';
 import { Fixtures } from '~test/fixtures';
 
@@ -705,5 +706,109 @@ describe('modules/manager/github-actions/extract', () => {
         },
       ]);
     });
+
+    it('extracts package from community actions', () => {
+      const yamlContent = dump({
+        jobs: {
+          build: {
+            steps: [
+              {
+                name: 'Pinning a minor version of uv',
+                uses: 'astral-sh/setup-uv@v5',
+                with: {
+                  version: 'latest',
+                },
+              },
+              {
+                uses: 'pnpm/action-setup@v4',
+                with: {
+                  version: 'latest',
+                },
+              },
+              {
+                name: 'Install gotestsum',
+                uses: 'jaxxstorm/[email protected]',
+                with: {
+                  repo: 'gotestyourself/gotestsum',
+                  tag: 'v1.12.1',
+                  platform: 'linux',
+                  arch: 'amd64',
+                },
+              },
+              {
+                name: 'Pinning a minor version of uv',
+                uses: 'astral-sh/setup-uv@v5',
+                with: {
+                  version: '0.4.x',
+                },
+              },
+              {
+                uses: 'pnpm/action-setup@v4',
+                with: {
+                  version: 10,
+                },
+              },
+              {
+                uses: 'pnpm/action-setup@v4',
+                with: {
+                  version: '10.x',
+                },
+              },
+              {
+                uses: 'pdm-project/[email protected]',
+                with: {
+                  version: '1.2.3',
+                },
+              },
+            ],
+          },
+        },
+      });
+
+      const res = extractPackageFile(yamlContent, 'workflow.yml');
+      expect(res?.deps.filter((pkg) => pkg.depType !== 'action')).toMatchObject(
+        [
+          {
+            currentValue: 'v1.12.1',
+            datasource: 'github-releases',
+            depName: 'gotestyourself/gotestsum',
+            depType: 'uses-with',
+            packageName: 'gotestyourself/gotestsum',
+          },
+          {
+            currentValue: '0.4.x',
+            datasource: 'github-releases',
+            depName: 'astral-sh/uv',
+            depType: 'uses-with',
+            packageName: 'astral-sh/uv',
+            versioning: 'npm',
+          },
+          {
+            currentValue: '10',
+            datasource: 'npm',
+            depName: 'pnpm',
+            depType: 'uses-with',
+            packageName: 'pnpm',
+            versioning: 'npm',
+          },
+          {
+            currentValue: '10.x',
+            datasource: 'npm',
+            depName: 'pnpm',
+            depType: 'uses-with',
+            packageName: 'pnpm',
+            versioning: 'npm',
+          },
+          {
+            currentValue: '1.2.3',
+            datasource: 'pypi',
+            depName: 'pdm',
+            depType: 'uses-with',
+            packageName: 'pdm',
+            versioning: 'pep440',
+          },
+        ],
+      );
+    });
   });
 });

lib/modules/manager/github-actions/extract.ts

@@ -1,17 +1,22 @@
 import is from '@sindresorhus/is';
+import { z } from 'zod';
 import { GlobalConfig } from '../../../config/global';
 import { logger } from '../../../logger';
 import { coerceArray, isNotNullOrUndefined } from '../../../util/array';
 import { detectPlatform } from '../../../util/common';
 import { newlineRegex, regEx } from '../../../util/regex';
+import { Result } from '../../../util/result';
 import { parseSingleYaml } from '../../../util/yaml';
 import { GiteaTagsDatasource } from '../../datasource/gitea-tags';
 import { GithubReleasesDatasource } from '../../datasource/github-releases';
 import { GithubRunnersDatasource } from '../../datasource/github-runners';
 import { GithubTagsDatasource } from '../../datasource/github-tags';
+import { NpmDatasource } from '../../datasource/npm';
+import { PypiDatasource } from '../../datasource/pypi';
 import * as dockerVersioning from '../../versioning/docker';
 import * as nodeVersioning from '../../versioning/node';
 import * as npmVersioning from '../../versioning/npm';
+import * as pep440versioning from '../../versioning/pep440';
 import { getDep } from '../dockerfile/extract';
 import type {
   ExtractConfig,
@@ -193,6 +198,89 @@ function extractRunners(runner: unknown): PackageDependency[] {
   return runners.map(extractRunner).filter(isNotNullOrUndefined);
 }
 
+const communityActions = [
+  {
+    // https://github.com/jaxxstorm/action-install-gh-release
+    use: /^jaxxstorm\/action-install-gh-release@.*$/,
+    schema: z
+      .object({ with: z.object({ repo: z.string(), tag: z.string() }) })
+      .transform(({ with: val }): PackageDependency => {
+        return {
+          datasource: GithubReleasesDatasource.id,
+          depName: val.repo,
+          packageName: val.repo,
+          currentValue: val.tag,
+          depType: 'uses-with',
+        };
+      }),
+  },
+  {
+    // https://github.com/astral-sh/setup-uv
+    use: /^astral-sh\/setup-uv@.*$/,
+    schema: z
+      .object({ with: z.object({ version: z.string() }) })
+      .transform(({ with: val }): PackageDependency | undefined => {
+        if (val.version === 'latest') {
+          return;
+        }
+
+        return {
+          datasource: GithubReleasesDatasource.id,
+          depName: 'astral-sh/uv',
+          versioning: npmVersioning.id,
+          packageName: 'astral-sh/uv',
+          currentValue: val.version,
+          depType: 'uses-with',
+        };
+      }),
+  },
+  {
+    // https://github.com/pnpm/action-setup
+    use: /^pnpm\/action-setup@.*$/,
+    schema: z
+      .object({
+        with: z.object({
+          version: z.union([
+            z.string(),
+            z.number().transform((s) => s.toString()),
+          ]),
+        }),
+      })
+      .transform(({ with: val }): PackageDependency | undefined => {
+        if (val.version === 'latest') {
+          return;
+        }
+
+        return {
+          datasource: NpmDatasource.id,
+          depName: 'pnpm',
+          versioning: npmVersioning.id,
+          packageName: 'pnpm',
+          currentValue: val.version,
+          depType: 'uses-with',
+        };
+      }),
+  },
+  {
+    // https://github.com/astral-sh/setup-uv
+    use: /^pdm-project\/setup-pdm@.*$/,
+    schema: z
+      .object({
+        with: z.object({ version: z.string().refine((s) => s !== 'head') }),
+      })
+      .transform(({ with: val }): PackageDependency | undefined => {
+        return {
+          datasource: PypiDatasource.id,
+          depName: 'pdm',
+          versioning: pep440versioning.id,
+          packageName: 'pdm',
+          currentValue: val.version,
+          depType: 'uses-with',
+        };
+      }),
+  },
+];
+
 function extractWithYAMLParser(
   content: string,
   packageFile: string,
@@ -246,6 +334,17 @@ function extractWithYAMLParser(
     };
 
     for (const step of coerceArray(job?.steps)) {
+      if (step.uses) {
+        for (const action of communityActions) {
+          if (action.use.test(step.uses)) {
+            const val = Result.parse(step, action.schema).unwrapOrNull();
+            if (val) {
+              deps.push(val);
+            }
+          }
+        }
+      }
+
       for (const [action, actionData] of Object.entries(actionsWithVersions)) {
         const actionName = `actions/setup-${action}`;
         if (