What the developer wrote
Authored by Jose Storopoli
ci: add cooldown to dependabot
What changed, and why it matters
This commit only changes how often the project's automated dependency bot checks for GitHub Actions updates. It adds a 60-day cooldown to Dependabot. There is no code change, no bug fix, and no security vulnerability being patched.
No security action needed. Review as a normal CI/process change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies .github/dependabot.yml to add a cooldown: default-days: 60 setting for GitHub Actions updates. This is a CI workflow configuration change that delays how quickly Dependabot proposes updates. It does not alter any Rust source code, cryptographic logic, network handling, or dependency versions actually used by the project.
Changed components
.github/dependabot.ymlInspect captured patch +4 / −0
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 453228e1..bf173427 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,3 +6,7 @@ updates:
schedule:
# Check for updates to GitHub Actions every week
interval: "weekly"
+ # Defines a cooldown period for dependency updates,
+ # allowing updates to be delayed for a configurable number of days.
+ cooldown:
+ default-days: 60
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.