Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Jan 6, 2026

This pull request updates the Dependabot configuration to increase the frequency of dependency update checks and introduces a cooldown period to help manage update noise.

Dependabot configuration changes:

  • Changed the update schedule interval from weekly to daily in .github/dependabot.yml.
  • Added a cooldown setting with default-days: 7 to limit how often Dependabot will open new pull requests for the same dependency.

…imit

Co-authored-by: MariusStorhaug <17722253+MariusStorhaug@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix insufficient cooldown in Dependabot updates Add open-pull-requests-limit to dependabot config for Zizmor compliance Jan 6, 2026
Copilot AI requested a review from MariusStorhaug January 6, 2026 22:34
@MariusStorhaug
Copy link
Member

@copilot I am thinking more what is mentioned here on this page under the section for cooldown.

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-

Co-authored-by: MariusStorhaug <17722253+MariusStorhaug@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Jan 6, 2026

@copilot I am thinking more what is mentioned here on this page under the section for cooldown.

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-refe...

You're absolutely right! I've updated the configuration to use the proper cooldown option with default-days: 3 instead of open-pull-requests-limit. This uses the official GitHub Dependabot cooldown feature that delays updates for 3 days after a new version is released, which is exactly what Zizmor expects. (commit e0bfad0)

@MariusStorhaug
Copy link
Member

@copilot Lets also set the schedule to be daily.

Copilot AI changed the title Add open-pull-requests-limit to dependabot config for Zizmor compliance Add cooldown configuration to dependabot config for Zizmor compliance Jan 6, 2026
Co-authored-by: MariusStorhaug <17722253+MariusStorhaug@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Jan 6, 2026

@copilot Lets also set the schedule to be daily.

Done! Changed the schedule interval to daily. (commit bb860f6)

@MariusStorhaug
Copy link
Member

@copilot Zizmor suggests 7 days. Lets use that.

Co-authored-by: MariusStorhaug <17722253+MariusStorhaug@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Jan 6, 2026

@copilot Zizmor suggests 7 days. Lets use that.

Updated to 7 days as recommended by Zizmor. (commit 082b9e0)

@MariusStorhaug MariusStorhaug marked this pull request as ready for review January 6, 2026 22:54
@MariusStorhaug MariusStorhaug merged commit 9820fd8 into main Jan 6, 2026
17 of 20 checks passed
@MariusStorhaug MariusStorhaug deleted the copilot/fix-dependabot-cooldown-issue branch January 6, 2026 23:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants