chore(ci): run Security Updates weekly instead of daily - #93
Merged
Conversation
The job finishes in well under a minute but is billed a full minute per run, so ~29 daily runs/month is almost entirely rounding overhead. Detection cadence is not the bottleneck for these alerts; merge latency is. Moves to Mondays 03:37 UTC. Claude-Session: https://claude.ai/code/session_01Xke8d7un3d7fBQcLHrkWr8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes the
Security Updatesworkflow from a daily schedule (03:30 UTC) to a weekly one (Mondays 03:37 UTC). Exactly one line changes; nothing else in the file is touched.Why
This repo runs the workflow ~29x/month at ~1.0 billed minute per run. Across the 10 affected repos that is ~145 billed min/month, essentially all of it per-job minimum-minute rounding — the job itself finishes in well under 60s.
Komorebi-AI hit 100% of its ~3,200 min/month Actions allowance in July (3,212 min used). This is one of three consolidations to get back under it.
Reducing the detection cadence is safe here because detection was never the bottleneck — merging is.
asistente-licitacionesPR #405 has been open since 27 June carrying fixes for 32 high-severity alerts, and its oldest open alert dates from 14 April (~108 days). Going from 1-day to 7-day detection latency is immaterial next to a ~100-day merge latency.This repo is included deliberately: it is the scaffold other repos are generated from, so changing it here stops newly generated repos inheriting the daily schedule.
This does not weaken the fix path
Only the cadence changes. 103 of 104 open alerts org-wide carry a verified patched version, and for those the bot passes
--exclude-newer-package <pkg>=<now>, which bypasses the repo'sexclude-newer = "7 days"uv policy.workflow_dispatchis also untouched, so the workflow can still be run on demand at any time.The
:37minute (rather than:30) is deliberate — GitHub delays scheduled workflows that pile onto the:00/:30marks.https://claude.ai/code/session_01Xke8d7un3d7fBQcLHrkWr8