Respect granularity of SemVer tag previously used

[bewuethr]

There are two (probably related) issues:

• When I have a tag such as v2.4.1, dependabot suggests upgrading to the less specific v3 instead of v3.0.0; issues:
  • GitHub Actions - full patch versions are bumped to minimal new major versions dependabot/dependabot-core#4768
  • Make dependabot respect granularity of previous semversioning dependabot/dependabot-core#4779
• A tag like v3 is sometimes upgraded to something more specific, such as v3.1.0
  • Dependabot doesn't pin to major version anymore with GitHub Actions dependabot/dependabot-core#3704 (supposedly fixed, but author of the issue still encounters the problem)

Edit 2022-03-18: just bumped into another, arguably worse scenario:

I have a repo with multiple workflows that uses actions/checkout in many places, say, a dozen or so. They're all on the latest version with full SemVer, v3.0.0.

Now, somebody adds a new workflows and uses an older version, v2.4.0.

The suggested update from dependabot is to revert everything to v3, i.e., also from v3.0.0 to v3. That's definitely not what I want as it doesn't even upgrade anything, it just effectively unpins my versions.

[bewuethr]

Looks like this was fixed in dependabot/dependabot-core#4953!