🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown #15
+10
−8
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull request overview
Configures Dependabot to check GitHub Actions updates daily while delaying newly released versions for 7 days, and updates workflows to use pinned GitHub Action SHAs.
Changes:
- Switch Dependabot
github-actionsupdate interval from weekly to daily. - Add a 7-day Dependabot cooldown for newly released versions.
- Pin GitHub Actions used in workflows to specific commit SHAs (instead of floating tags like
latest).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/dependabot.yml |
Adjusts Dependabot schedule to daily and adds a 7-day cooldown. |
.github/workflows/Linter.yml |
Pins actions/checkout and super-linter to commit SHAs. |
.github/workflows/Auto-Release.yml |
Pins actions/checkout and PSModule/Auto-Release to commit SHAs. |
.github/workflows/Action-Test.yml |
Pins actions/checkout and actions/upload-artifact to commit SHAs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+14
to
+16
| interval: daily | ||
| cooldown: | ||
| default-days: 7 |
There was a problem hiding this comment.
The PR description says only .github/dependabot.yml was updated, but this PR also changes multiple workflow files to pin GitHub Actions to specific commit SHAs. Please update the PR description/title to include these workflow changes (or split them into a separate PR) so reviewers understand the full scope.
MariusStorhaug
changed the title
MariusStorhaug
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Configure Dependabot for daily schedule with 7-day cooldown
Changes
.github/dependabot.yml:weeklytodailyforgithub-actionsecosystemcooldownconfiguration withdefault-days: 7Why
The cooldown option delays version updates for 7 days after a dependency release, giving time for issues to surface before updating. This provides more timely updates while still allowing stability.