Skip to content

Conversation

@MariusStorhaug
Copy link
Member

@MariusStorhaug MariusStorhaug commented Jan 22, 2026

Improves dependency management by configuring Dependabot to check daily while preventing excessive update noise through a 7-day cooldown period. This ensures timely security updates while reducing PR churn.

  • Related to PSModule workflow standardization

Dependabot configuration

Changed the update schedule from weekly to daily with a 7-day cooldown period. This provides faster detection of security vulnerabilities while avoiding duplicate PRs for the same dependency within a week.

schedule:
  interval: daily
cooldown:
  default-days: 7

Release configuration cleanup

Removed the deprecated .github/release.yml file as release notes are now managed through the Auto-Release action's automated process.

Action pinning

Pinned all GitHub Actions to specific commit SHAs for improved security and reproducibility:

  • actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6.0.2)
  • super-linter/super-linter@d5b0a2ab116623730dd094f15ddc1b6b25bf7b99 (v8.3.2)
  • PSModule/Auto-Release@eabd533035e2cb9822160f26f2eda584bd012356 (v1.9.5)

Copilot AI review requested due to automatic review settings January 22, 2026 18:18
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to update Dependabot configuration to run daily with a 7-day cooldown period, but includes additional unrelated changes and contains a critical configuration error.

Changes:

  • Modified .github/dependabot.yml to change schedule from weekly to daily and attempted to add a cooldown configuration
  • Updated GitHub Actions versions in three workflow files with pinned commit hashes
  • Deleted .github/release.yml file containing release note configuration

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
.github/dependabot.yml Changed schedule interval to daily and added invalid cooldown configuration
.github/workflows/Linter.yml Updated actions/checkout to v6.0.2 and super-linter to v8.3.2 with commit hash pinning
.github/workflows/Auto-Release.yml Updated actions/checkout to v6.0.2 and PSModule/Auto-Release to v1.9.5 with commit hash pinning
.github/workflows/Action-Test.yml Updated actions/checkout to v6.0.2 with commit hash pinning
.github/release.yml Completely removed release notes configuration file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +15 to +16
cooldown:
default-days: 7
Copy link

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The cooldown configuration option is not a valid Dependabot configuration as of January 2025. This option does not exist in the GitHub Dependabot documentation. If you want to delay updates after a dependency release, you would need to use other mechanisms such as the open-pull-requests-limit option to control the rate of updates, or handle this through your PR review process. The valid Dependabot configuration options are documented at https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates

Suggested change
cooldown:
default-days: 7
open-pull-requests-limit: 5

Copilot uses AI. Check for mistakes.
Comment on lines +14 to +16
interval: daily
cooldown:
default-days: 7
Copy link

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description states only that Dependabot configuration is being updated, but this PR also includes updates to GitHub Actions versions (actions/checkout@v6.0.2, super-linter/super-linter@v8.3.2, PSModule/Auto-Release@v1.9.5) and deletes the .github/release.yml file. The PR description should be updated to accurately reflect all changes being made, or these additional changes should be in a separate PR if they are unrelated to the Dependabot configuration update.

Copilot uses AI. Check for mistakes.
- github-actions
schedule:
interval: weekly
interval: daily
Copy link

Copilot AI Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changing the Dependabot schedule from weekly to daily will significantly increase the frequency of dependency update PRs. Without the cooldown mechanism (which is not a valid configuration option), this could result in daily PRs for GitHub Actions updates. Consider whether this increased frequency aligns with your maintenance capacity. If you want more frequent checks but controlled PR creation, consider using open-pull-requests-limit to cap the number of concurrent update PRs Dependabot can create.

Copilot uses AI. Check for mistakes.
@MariusStorhaug MariusStorhaug changed the title 🩹 Configure Dependabot for daily schedule with 7-day cooldown 🩹[Patch] Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug changed the title 🩹[Patch] Configure Dependabot for daily schedule with 7-day cooldown 🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug changed the title 🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown 🩹 [Patch] Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug changed the title 🩹 [Patch] Configure Dependabot for daily schedule with 7-day cooldown 🩹[Patch]: Configure Dependabot for daily schedule with 7-day cooldown Jan 22, 2026
@MariusStorhaug MariusStorhaug self-assigned this Jan 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants