Skip to content

Commit a4a789a

Browse files
committed
chore(deps): update Dependabot configuration for GitHub Actions
1 parent 4d5cdda commit a4a789a

1 file changed

Lines changed: 13 additions & 19 deletions

File tree

.github/dependabot.yml

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,7 @@
22
# Dependabot Configuration
33
#
44
# Purpose:
5-
# • Keep Go modules, GitHub Actions and DevContainer images/features
6-
# base images up‑to‑date with zero‑day security patches and semantic‑version
7-
# upgrades.
5+
# • Keep GitHub Actions updated with the latest security patches and features.
86
# • Reduce attack surface by limiting outdated dependencies.
97
# • Minimise PR noise via smart grouping and sane pull‑request limits.
108
#
@@ -13,13 +11,13 @@
1311
# https://docs.github.com/en/code-security/dependabot/configuration-options-for-dependency-updates
1412
#
1513
# Security Hardened Defaults:
16-
# • Weekly cadence (Monday 09:00 America/New_York) – align with CVE dump cycle.
14+
# • Weekly cadence (Tuesday 11:00 America/New_York) – align with typical maintenance windows.
1715
# • Direct dependencies only – prevents unsolicited transitive churn.
18-
# • PRs labeled, assigned, and target the protected "master" branch.
16+
# • PRs labeled, assigned, and target the protected master branch.
1917
# • PR titles prefixed with chore(scope): – conventional commits.
2018
# • Force‑push and delete‑branch disabled via branch‑protection rules.
2119
# • PR limit = 10 to avoid queue flooding.
22-
# • All dependency PRs require passing CI + CODEOWNERS review.
20+
# • All dependency PRs require passing CI checks before merging.
2321
# ────────────────────────────────────────────────────────────────
2422

2523
version: 2
@@ -33,19 +31,15 @@ updates:
3331
target-branch: "master"
3432
schedule:
3533
interval: "weekly"
36-
day: "monday"
37-
time: "09:00"
34+
day: "tuesday"
35+
time: "11:00"
3836
timezone: "America/New_York"
3937
allow:
4038
- dependency-type: "direct"
4139
groups:
42-
security-deps:
43-
patterns:
44-
- "*crypto*"
45-
- "*security*"
46-
- "*auth*"
47-
- "*jwt*"
48-
- "*oauth*"
40+
gomod-all:
41+
applies-to: version-updates
42+
patterns: ["*"]
4943
update-types: ["minor", "patch"]
5044
open-pull-requests-limit: 10
5145
assignees: ["mrz1836"]
@@ -62,8 +56,8 @@ updates:
6256
target-branch: "master"
6357
schedule:
6458
interval: "weekly"
65-
day: "monday"
66-
time: "09:15"
59+
day: "tuesday"
60+
time: "11:15"
6761
timezone: "America/New_York"
6862
allow:
6963
- dependency-type: "direct"
@@ -85,8 +79,8 @@ updates:
8579
target-branch: "master"
8680
schedule:
8781
interval: "weekly"
88-
day: "monday"
89-
time: "09:30"
82+
day: "tuesday"
83+
time: "11:30"
9084
timezone: "America/New_York"
9185
allow:
9286
- dependency-type: "direct"

0 commit comments

Comments
 (0)