Skip to content

Conversation

@MariusStorhaug
Copy link
Member

@MariusStorhaug MariusStorhaug commented Jan 22, 2026

Improves dependency management by configuring Dependabot to check daily while preventing excessive update noise through a 7-day cooldown period. This ensures timely security updates while reducing PR churn.

  • Related to PSModule workflow standardization

Dependabot configuration

Changed the update schedule from weekly to daily with a 7-day cooldown period. This provides faster detection of security vulnerabilities while avoiding duplicate PRs for the same dependency within a week.

schedule:
  interval: daily
cooldown:
  default-days: 7

Release configuration cleanup

Removed the deprecated .github/release.yml file as release notes are now managed through the Auto-Release action's automated process.

Action pinning

Pinned all GitHub Actions to specific commit SHAs for improved security and reproducibility:

  • actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2)
  • super-linter/super-linter@d5b0a2ab116623730dd094f15ddc1b6b25bf7b99 (v8.3.2)
  • PSModule/Auto-Release@eabd533035e2cb9822160f26f2eda584bd012356 (v1.9.5)

Copilot AI review requested due to automatic review settings January 22, 2026 18:18
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to configure Dependabot for more frequent checks with a cooldown period, but includes several undocumented changes. The main focus is updating the Dependabot schedule from weekly to daily with a 7-day cooldown configuration.

Changes:

  • Modified Dependabot schedule interval from weekly to daily
  • Added cooldown configuration with 7-day default
  • Updated GitHub Actions to use commit SHA pinning in workflow files
  • Removed .github/release.yml configuration file

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
.github/dependabot.yml Changed schedule interval to daily and added cooldown configuration
.github/workflows/Linter.yml Pinned actions/checkout and super-linter to specific commit SHAs
.github/workflows/Auto-Release.yml Pinned actions/checkout and PSModule/Auto-Release to specific commit SHAs
.github/workflows/Action-Test.yml Pinned actions/checkout to specific commit SHA
.github/release.yml Deleted release notes configuration file
Comments suppressed due to low confidence (1)

.github/release.yml:1

  • The deletion of .github/release.yml is not mentioned in the PR description. This file configures automatically generated release notes, and its removal is a significant change that affects how releases are documented. The PR description should explain why this file is being removed and what the impact will be on the release process.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +15 to +16
cooldown:
default-days: 7
Copy link

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cooldown configuration option is not a valid Dependabot configuration setting. According to the GitHub Dependabot documentation (https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file), the valid configuration options for the schedule section are interval, day, time, and timezone. The cooldown option does not exist in the official Dependabot configuration schema.

If the goal is to delay updates after a dependency release, this cannot be achieved through Dependabot's native configuration. Consider alternative approaches such as:

  1. Using a weekly schedule (the original configuration) to naturally provide time between updates
  2. Implementing custom workflows with delay logic
  3. Using label-based filtering to manually control when updates are merged
Suggested change
cooldown:
default-days: 7

Copilot uses AI. Check for mistakes.
Comment on lines +22 to +27
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Lint code base
uses: super-linter/super-linter@latest
uses: super-linter/super-linter@d5b0a2ab116623730dd094f15ddc1b6b25bf7b99 # v8.3.2
Copy link

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR includes multiple workflow updates that pin GitHub Actions to specific commit SHAs, but these changes are not mentioned in the PR description. The PR description only mentions changes to the Dependabot configuration. Consider either:

  1. Updating the PR description to document all changes including the workflow updates
  2. Splitting these changes into a separate PR focused on dependency updates

The undocumented changes include pinning actions/checkout, super-linter/super-linter, and PSModule/Auto-Release to specific versions.

Copilot uses AI. Check for mistakes.
@MariusStorhaug MariusStorhaug changed the title 🩹 Configure Dependabot for daily schedule with 7-day cooldown 🩹[Patch] Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug changed the title 🩹[Patch] Configure Dependabot for daily schedule with 7-day cooldown 🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug changed the title 🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown 🩹 [Patch] Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug changed the title 🩹 [Patch] Configure Dependabot for daily schedule with 7-day cooldown 🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug self-assigned this Jan 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants