Conversation
dependabot.yml sets no groups, so every dependency bump opens its own PR with its own CI run. Group minor and patch updates per ecosystem into a single weekly PR, and leave majors ungrouped so they are still reviewed individually.
zizmor audits dependabot.yml and flags each update entry without a cooldown as a Medium finding, which fails the zizmor-output check. It only scans changed files, so the finding was latent until this PR touched the file. Cooldown also stands on its own: letting a release age before adopting it narrows the window in which a compromised or immediately-yanked version gets pulled in.
Coverage (unit tests)No unit baseline recorded in
Line and branch coverage from unit test reports. History is recorded in |
Contributor
Code Coverage
|
Dependabot's own config check rejected the file: The property '#/updates/1/cooldown/semver-major-days' is not supported for the package ecosystem 'github-actions'. (same for minor and patch) The semver-*-days breakdown is only valid for ecosystems that carry semver metadata, so github-actions keeps default-days alone. Gradle is unchanged.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
.github/dependabot.ymldeclares both ecosystems but sets nogroups:, so every dependency bump opens its own PR with its own CI run. There are 2 open right now, and the steady-state noise is higher than it needs to be.Change
Group routine minor and patch updates into one PR per ecosystem per week. Major bumps stay ungrouped so they keep getting individual review, which is where the actual risk lives.
Notes
chore(deps)commit prefix, oropen-pull-requests-limit.android-maps-utilsandandroid-samples, which have the same gap.android-samplesis the worst affected, with 12 of 32 open PRs coming from dependabot.Also added: dependabot cooldown
The
zizmorsecurity scan flags everyupdates:entry without acooldown:as a Medium finding, which failszizmor-output. It only audits changed files, so the finding was latent until this PR toucheddependabot.yml.Added a cooldown (7 days default, 14 for majors, 3 for patches). It also stands on its own merits: letting a release age before adopting it narrows the window in which a compromised or immediately-yanked version gets pulled in.
zizmor-outputis green with it in place.