⚙️ [Maintenance]: Dependabot updates retain default cooldown

[Marius Storhaug (MariusStorhaug)]

Dependabot version-update pull requests continue to use the three-day cooldown built into Dependabot, without repository-specific configuration that duplicates the default.

Changed: Cooldown configuration

GitHub Actions and Python dependency updates continue to run at 0 9 * * 1,3,5 in Europe/Oslo with their existing labels, and each dependency update remains an independent pull request.

---

Technical details

• Removed the explicit cooldown.default-days: 3 mappings and their inline Zizmor suppressions from .github/dependabot.yml; Dependabot's documented default preserves the same version-update behavior.
• Added .github/linters/zizmor.yaml to disable only dependabot-cooldown: Zizmor 1.25.2 requires an explicit cooldown mapping even when configured with a three-day threshold, so it cannot represent Dependabot's equivalent implicit default. Super-Linter invokes this configuration path directly.
• Documented the three-day default and the reason version updates wait in the dependency-update requirement and design and in the GitHub Actions standard. Security updates continue to bypass the cooldown.
• Validation: strict offline Zizmor collection using Super-Linter's configuration path for the Dependabot file and the full repository reports no findings; YAML parsing confirms the two update entries retain their schedules and labels and contain neither cooldown nor grouping configuration; documentation-index and link verification, Zensical build, and all 87 Pester tests pass.
• Implementation plan progress: all six steps in Remove redundant Dependabot cooldown configuration #173 are complete.
• The topic branch is named remove-dependabot-cooldown rather than <type>/<issue>-<slug> because the required one-time session rename occurred before the delivery Task existed; the Copilot app cannot rename it again or retain a slash.
• Issue convergence sweep: searched open MSXOrg/docs issues for cooldown; Remove redundant Dependabot cooldown configuration #173 is the only delivery issue fully satisfied by this diff.

Changed surface	Standards checked	Framework docs checked	Result
.github/dependabot.yml	Dependabot scheduling, labels, and independent-update configuration	Dependency Updates design	Aligned
.github/linters/zizmor.yaml	Zizmor rule configuration and Super-Linter configuration path	None (no framework-specific docs)	Aligned
src/docs/Capabilities/dependency-updates/**	Markdown; Dependency Updates spec and design	Dependency Updates capability	Fixed in this PR
src/docs/Coding-Standards/GitHub-Actions.md	Markdown; GitHub Actions standard	Dependency Updates capability	Fixed in this PR

Relevant issues (or links)

• Resolves Remove redundant Dependabot cooldown configuration #173

Related work

• References ⚙️ [Maintenance]: Dependency updates run independently #168

[Copilot]

Pull request overview

This PR removes the explicit Dependabot version-update cooldown configuration so the repository relies on Dependabot’s documented default (3 days), while keeping the existing schedules, time zone, labels, and “one PR per dependency” behavior unchanged.

Changes:

• Removed cooldown.default-days: 3 from both github-actions and pip update entries.
• Removed the inline zizmor suppression comments that were only needed due to the explicit cooldown mapping.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/dependabot.yml:26

• Same as above: consider documenting that this entry relies on Dependabot’s implicit 3-day default cooldown now that the explicit config was removed.

    schedule:
      interval: cron
      cronjob: "0 9 * * 1,3,5"
      timezone: Europe/Oslo

.github/zizmor.yml:3

• The zizmor suppression disables a security rule but doesn’t document why the exception is safe/required. Adding a short rationale here will make the suppression auditable when someone later asks why this rule is turned off.

rules:
  dependabot-cooldown:
    disable: true

.github/dependabot.yml:16

• With the explicit cooldown removed, it’s no longer obvious to readers that Dependabot still enforces a (default) cooldown for version updates. Consider adding a brief comment noting that this relies on Dependabot’s implicit 3-day default to preserve intent without duplicating config.

This issue also appears on line 23 of the same file.

    schedule:
      interval: cron
      cronjob: "0 9 * * 1,3,5"
      timezone: Europe/Oslo

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/linters/zizmor.yaml:4

• This introduces the repo’s first *.yaml file, but the YAML coding standard says every YAML file MUST use the .yml extension (with .pre-commit-config.yaml as the only documented exception). If Zizmor/Super-Linter does not hard-require .yaml, consider renaming this to zizmor.yml; if it does, the exception should be documented in src/docs/Coding-Standards/YAML.md (and any other relevant standards) so the repo doesn’t drift from its own lintability rules.

---
rules:
  dependabot-cooldown:
    disable: true

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/linters/zizmor.yaml:4

• zizmor rule configuration uses enabled: false to disable a rule; disable: true is not recognized per zizmor’s config schema, so this file likely won’t have the intended effect and CI may still report dependabot-cooldown findings.

rules:
  dependabot-cooldown:
    disable: true