From 227daa2f65d3467c9ec5de6a259cb55dc3969947 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 13:16:37 +0200 Subject: [PATCH 1/4] Remove redundant Dependabot cooldown configuration Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/dependabot.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index dcc12db..2ef3e7c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,8 +14,6 @@ updates: interval: cron cronjob: "0 9 * * 1,3,5" timezone: Europe/Oslo - cooldown: - default-days: 3 # zizmor: ignore[dependabot-cooldown] Three days is the approved organizational cooldown. - package-ecosystem: pip # Build toolchain pinned in requirements.txt directory: / @@ -26,5 +24,3 @@ updates: interval: cron cronjob: "0 9 * * 1,3,5" timezone: Europe/Oslo - cooldown: - default-days: 3 # zizmor: ignore[dependabot-cooldown] Three days is the approved organizational cooldown. From c3a509bb82ca80dbe50c490a9c2fdabad47beebe Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 13:21:04 +0200 Subject: [PATCH 2/4] Align Zizmor with Dependabot default cooldown Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/zizmor.yml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..5f77178 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,3 @@ +rules: + dependabot-cooldown: + disable: true From 67f33288e0be7a0ded25c16857f94d9149b1dce8 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 13:26:41 +0200 Subject: [PATCH 3/4] Load Zizmor policy through Super-Linter Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/{zizmor.yml => linters/zizmor.yaml} | 1 + 1 file changed, 1 insertion(+) rename .github/{zizmor.yml => linters/zizmor.yaml} (92%) diff --git a/.github/zizmor.yml b/.github/linters/zizmor.yaml similarity index 92% rename from .github/zizmor.yml rename to .github/linters/zizmor.yaml index 5f77178..6b55013 100644 --- a/.github/zizmor.yml +++ b/.github/linters/zizmor.yaml @@ -1,3 +1,4 @@ +--- rules: dependabot-cooldown: disable: true From 1ce5665faea492d8ae369c0ae95b289d0a150536 Mon Sep 17 00:00:00 2001 From: Marius Storhaug Date: Sat, 15 Aug 2026 13:35:35 +0200 Subject: [PATCH 4/4] Document Dependabot default cooldown Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- src/docs/Capabilities/dependency-updates/design.md | 9 ++++++--- src/docs/Capabilities/dependency-updates/spec.md | 2 +- src/docs/Coding-Standards/GitHub-Actions.md | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/src/docs/Capabilities/dependency-updates/design.md b/src/docs/Capabilities/dependency-updates/design.md index eddc701..1117083 100644 --- a/src/docs/Capabilities/dependency-updates/design.md +++ b/src/docs/Capabilities/dependency-updates/design.md @@ -60,6 +60,8 @@ proposal. It costs a few days of currency and buys the chance for an upstream pr to withdraw or supersede a bad release before every consumer has a pull request open against it. Currency is the goal; being first is not. +The organization standard is Dependabot's implicit **three-day** cooldown for version updates. Repositories omit `cooldown` when they use that standard; an explicit mapping records a deliberate non-default duration. + Security updates ignore both settings. An advisory means the pinned version is known bad now, and waiting for a schedule window or a cooldown would be waiting on purpose. @@ -67,8 +69,9 @@ bad now, and waiting for a schedule window or a cooldown would be waiting on pur Dependabot opens **one PR per outdated or vulnerable dependency**, carrying the bump and the upstream release notes. SHA-pinned dependencies get the new commit -SHA with the version as a trailing comment. Ecosystems, directories, schedule, -cooldown, and the static labels all live in `.github/dependabot.yml`. +SHA with the version as a trailing comment. Ecosystems, directories, schedule, and +the static labels live in `.github/dependabot.yml`; a non-default cooldown belongs +there too, while the standard three-day cooldown remains implicit. ```mermaid flowchart TD @@ -160,7 +163,7 @@ and the same release path as any other update. | Native ecosystems and directories | `.github/dependabot.yml` | Generated from supported manifests | | Unsupported ecosystems | Central exception register | Centrally managed shared mechanism | | Schedule (`interval`, `day` and `time`, or `cronjob`) and `timezone` | `.github/dependabot.yml` | Organization configuration | -| Cooldown | `.github/dependabot.yml` | Organization configuration | +| Cooldown | Dependabot default (three days); explicit mapping only for a deliberate non-default duration | Organization configuration | | Static labels (`dependencies` + ecosystem) | `.github/dependabot.yml` | Generated | | `update:*` labels | Update metadata → labelling step | Derived per pull request | | Automatic-merge policy | Branch protection and merge automation | Organization configuration | diff --git a/src/docs/Capabilities/dependency-updates/spec.md b/src/docs/Capabilities/dependency-updates/spec.md index c4efe15..cc54ab3 100644 --- a/src/docs/Capabilities/dependency-updates/spec.md +++ b/src/docs/Capabilities/dependency-updates/spec.md @@ -63,7 +63,7 @@ Management](../release-management/spec.md). - **FR6 — Currency is checked on a schedule.** No human watches upstream releases. - **FR7 — The schedule is configuration.** Frequency and the timezone it is expressed in MUST be configurable per organization. There is no correct global cadence: a repository whose consumers deploy continuously wants updates sooner than one that ships quarterly, and a schedule expressed in a timezone nobody works in produces pull requests nobody triages. -- **FR8 — Freshly published versions wait.** A version MUST NOT be proposed the moment it appears. A cooldown between publication and proposal lets an upstream project withdraw or supersede a bad release before every consumer has a pull request open against it. +- **FR8 — Freshly published versions wait three days.** A version MUST NOT be proposed the moment it appears. The organization standard is Dependabot's default three-day cooldown, so a repository MUST omit an explicit `cooldown` mapping unless it deliberately adopts a non-default duration. The delay lets an upstream project withdraw or supersede a bad release before every consumer has a pull request open against it. - **FR9 — Security advisories bypass the schedule.** An advisory affecting a pin raises an update on disclosure, out of band, and MUST be prioritised over scheduled currency updates. ### Review and labelling diff --git a/src/docs/Coding-Standards/GitHub-Actions.md b/src/docs/Coding-Standards/GitHub-Actions.md index 202f5df..f20a69a 100644 --- a/src/docs/Coding-Standards/GitHub-Actions.md +++ b/src/docs/Coding-Standards/GitHub-Actions.md @@ -53,7 +53,7 @@ stale, unpatched code. - **Enable automated updates for the `github-actions` ecosystem** in `.github/dependabot.yml`. The updater opens a pull request that rewrites the pin to the new commit SHA and refreshes the trailing version comment. -- **Apply a cooldown** before adopting a freshly published version. +- **Apply Dependabot's default three-day cooldown** before adopting a freshly published version. Omit an explicit `cooldown` mapping unless the repository deliberately adopts a non-default duration. - **Label the update PR** with `dependencies` + `github-actions`, plus the dependency's own level (`update:major` / `update:minor` / `update:patch`). These update-level labels are deliberately **distinct from the release-bump