Skip to content

chore(ci): slow down dependabot, pin actions by sha#282

Merged
rvagg merged 1 commit into
masterfrom
rvagg/depbot
Jul 21, 2026
Merged

chore(ci): slow down dependabot, pin actions by sha#282
rvagg merged 1 commit into
masterfrom
rvagg/depbot

Conversation

@rvagg

@rvagg rvagg commented Jul 21, 2026

Copy link
Copy Markdown
Member

No description provided.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates CI configuration to reduce Dependabot update frequency and improve GitHub Actions supply-chain safety by pinning selected uses: references to exact commit SHAs.

Changes:

  • Pin several GitHub Actions (and gateway-conformance composite actions) to specific commit SHAs in workflows.
  • Slow Dependabot update cadence from weekly to monthly for github-actions and gomod.
  • Add a Dependabot cooldown configuration to both update entries.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
.github/workflows/release-binaries.yml Pins checkout/setup-go/goreleaser action references to commit SHAs.
.github/workflows/gateway-conformance.yml Pins gateway-conformance composite actions and common actions (checkout/setup-go/upload-artifact) to commit SHAs.
.github/dependabot.yml Changes update schedule to monthly and introduces a cooldown setting.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/release-binaries.yml
@rvagg
rvagg merged commit 8e16e52 into master Jul 21, 2026
9 checks passed
@rvagg
rvagg deleted the rvagg/depbot branch July 21, 2026 05:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants