ci(dependabot): add a 10-day cooldown on all ecosystems#62
Merged
Conversation
Dependabot will not propose a dependency release until it has been public for at least 10 days, so a freshly published (possibly compromised or soon-yanked) version is never auto-PR'd before the ecosystem can react. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
cooldown: { default-days: 10 }to every Dependabot ecosystem (gomod, github-actions).Why: a cooldown means Dependabot won't open a PR for a release until it has been public for at least 10 days — so a freshly published, possibly compromised or soon-yanked version is never auto-proposed before the ecosystem has had time to react. This is the supply-chain backstop for the SHA/digest pinning added in the CI-hardening PRs.
Effect on the current backlog: on the next Dependabot run, in-flight PRs targeting releases younger than 10 days are deferred/closed and re-created once they age past the window. PRs for releases already older than 10 days are unaffected.
🤖 Generated with Claude Code