One could write an action that executes a shell script that does docker pull abc:latest.

As the consumer of an action that becomes really hard to find out unless I take the whole codebase apart.