From e5dbe8439703e5b74e04dc2f15e9f14ee9c0a6d1 Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Wed, 29 Jul 2026 17:44:48 -0500 Subject: [PATCH 1/2] Add cooldown period for Dependabot updates --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..d073bec1 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,13 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file + +version: 2 +updates: + - package-ecosystem: "" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "weekly" + cooldown: + default-days: 7 From ca1b603a5b95586c7649ed7a0d8713ab1d7b3912 Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Wed, 14 Oct 2026 14:16:59 -0700 Subject: [PATCH 2/2] Configure Dependabot for github-actions and gomod Replace the unfilled template (empty package-ecosystem) with real ecosystems. Keep the 7-day cooldown on both; gh-actions-lock reads the github-actions default-days as its own fresh-release policy. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d073bec1..fad4545a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,13 +1,22 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file - +# gh-actions-lock reads the github-actions cooldown below as its own +# fresh-release policy; it honors only default-days. version: 2 updates: - - package-ecosystem: "" # See documentation for possible values - directory: "/" # Location of package manifests + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + cooldown: + default-days: 7 + + - package-ecosystem: "gomod" + directory: "/" schedule: interval: "weekly" cooldown: default-days: 7 + groups: + go-minor-and-patch: + update-types: + - "minor" + - "patch"