From 193d5af639eef3a7670682982f49b05dd5e8e8f2 Mon Sep 17 00:00:00 2001 From: Benoit Tigeot Date: Wed, 29 Jul 2026 17:20:35 +0200 Subject: [PATCH] ci: enforce 7-day cooldown on dependabot updates Give a week for new dependency releases to be vetted before Dependabot opens PRs, reducing exposure to freshly published malicious versions. Signed-off-by: Benoit Tigeot --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1b1de9e55..b795dde19 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -17,6 +17,8 @@ updates: - "k8s.io/cli-runtime" - "k8s.io/client-go" - "k8s.io/kubectl" + cooldown: + default-days: 7 - package-ecosystem: "gomod" target-branch: "main" directory: "/" @@ -32,6 +34,8 @@ updates: - "k8s.io/cli-runtime" - "k8s.io/client-go" - "k8s.io/kubectl" + cooldown: + default-days: 7 - package-ecosystem: "github-actions" target-branch: "main" directory: "/" @@ -41,6 +45,8 @@ updates: github-actions: patterns: - "*" + cooldown: + default-days: 7 - # Keep dev-v3 GitHub Actions up to date, while Helm v3 is within support package-ecosystem: "github-actions" target-branch: "dev-v3" @@ -51,3 +57,5 @@ updates: github-actions: patterns: - "*" + cooldown: + default-days: 7