-
Notifications
You must be signed in to change notification settings - Fork 0
🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown #55
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR aims to configure Dependabot to check for GitHub Actions updates on a daily schedule with a 7-day cooldown period before creating update PRs. However, the PR also includes unrelated changes to workflow files and configuration.
Changes:
- Modified Dependabot configuration to use daily schedule and added a cooldown configuration
- Updated GitHub Actions to use pinned commit hashes across multiple workflow files
- Deleted
.github/release.ymlconfiguration file
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
.github/dependabot.yml |
Changed schedule from weekly to daily and added cooldown configuration with 7-day default |
.github/workflows/Linter.yml |
Pinned actions/checkout to v6.0.2 and super-linter to v8.3.2 with commit hashes |
.github/workflows/Auto-Release.yml |
Pinned actions/checkout to v6.0.2 and PSModule/Auto-Release to v1.9.5 with commit hashes |
.github/workflows/Action-Test.yml |
Pinned actions/checkout to v6.0.2 and PSModule/GitHub-Script to v1.7.8 with commit hashes across multiple jobs |
.github/release.yml |
Completely removed the release configuration file |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Lint code base | ||
| uses: super-linter/super-linter@latest | ||
| uses: super-linter/super-linter@d5b0a2ab116623730dd094f15ddc1b6b25bf7b99 # v8.3.2 |
Copilot
AI
Jan 22, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This PR includes updates to GitHub Actions versions in workflow files (pinning actions/checkout to v6.0.2, super-linter to v8.3.2, PSModule/Auto-Release to v1.9.5, and PSModule/GitHub-Script to v1.7.8) which are not mentioned in the PR description. The PR description only mentions changes to .github/dependabot.yml to configure a daily schedule with cooldown. These workflow updates should either be mentioned in the PR description or moved to a separate PR to maintain clear change boundaries.
| cooldown: | ||
| default-days: 7 |
Copilot
AI
Jan 22, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The cooldown configuration option is not a valid Dependabot configuration option. According to the GitHub Dependabot documentation, there is no cooldown option available. The valid configuration options include schedule, open-pull-requests-limit, allow, ignore, labels, reviewers, assignees, milestone, commit-message, rebase-strategy, target-branch, vendor, versioning-strategy, insecure-external-code-execution, and registries, but not cooldown. This configuration will be ignored by Dependabot and will not achieve the intended 7-day delay for updates.
| cooldown: | |
| default-days: 7 |
Improves dependency management by configuring Dependabot to check daily while preventing excessive update noise through a 7-day cooldown period. This ensures timely security updates while reducing PR churn.
Dependabot configuration
Changed the update schedule from weekly to daily with a 7-day cooldown period. This provides faster detection of security vulnerabilities while avoiding duplicate PRs for the same dependency within a week.
Release configuration cleanup
Removed the deprecated
.github/release.ymlfile as release notes are now managed through the Auto-Release action's automated process.Action pinning
Pinned all GitHub Actions to specific commit SHAs for improved security and reproducibility:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd(v6.0.2)actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4(v5.0.0)super-linter/super-linter@d5b0a2ab116623730dd094f15ddc1b6b25bf7b99(v8.3.2)PSModule/Auto-Release@eabd533035e2cb9822160f26f2eda584bd012356(v1.9.5)PSModule/GitHub-Script@2010983167dc7a41bcd84cb88e698ec18eccb7ca(v1.7.8)