chore(deps): add 3-day Dependabot cooldown for cargo and github-actions - #1163
Conversation
Delay version-update PRs until dependencies are at least three days old, reducing the risk of pulling a freshly compromised release into a tagged build. Security updates are unaffected and still bypass cooldown. Signed-off-by: Aleksy Siek <aleksy@alwaysfurther.ai>
PR Review SummarySize
Affected cratesNo crate source directories are directly affected. Blast radius — ContainedThis PR touches: configuration / policy files Updated automatically on each push to this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request attempts to introduce a cooldown period for Dependabot updates to delay version-update PRs. However, the review comments correctly point out that cooldown is not a supported configuration option in dependabot.yml and will cause schema validation errors, preventing Dependabot from running.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
…ns (nolabs-ai#1163) Delay version-update PRs until dependencies are at least three days old, reducing the risk of pulling a freshly compromised release into a tagged build. Security updates are unaffected and still bypass cooldown. Signed-off-by: Aleksy Siek <aleksy@alwaysfurther.ai>
2 participants
Linked Issue
Closes #1162
Summary
Delay version-update PRs until dependencies are at least three days old, reducing the risk of pulling a freshly compromised release into a tagged build. Security updates are unaffected and still bypass cooldown.
Test Plan
Checklist
CHANGELOG.mdif needed