From 333cb5d0854a393e1cabacac7cbcb0622a6b52a7 Mon Sep 17 00:00:00 2001 From: Lucas Ramos <3140800+lucas-d-ramos@users.noreply.github.com> Date: Fri, 21 Aug 2026 14:21:41 +0200 Subject: [PATCH] =?UTF-8?q?chore(dependabot):=20Tier=201=20policy=20?= =?UTF-8?q?=E2=80=94=20daily=2005:00=20UTC,=20cooldown=207,=20no=20majors?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo is Tier 1: production ships when the floating vMAJOR tag moves by hand, not when a PR merges. Consumers pin @v14 and never read main, so main is effectively staging and auto-merging patch+minor onto it is safe for the same reason it is safe in donation-form. It sat in Tier 2 in earlier drafts, which was wrong — Tier 2's defining claim is that the merge IS the deploy, and here it deploys nothing. Adds the two org constants this config was missing entirely: a 7-day cooldown and an ignore for all major version updates. Note ignore covers version updates only; a security major can still open a PR, and the auto-merge workflow's update-type gate is what refuses to merge it. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ffa7c2d..1f44c7f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,10 +1,33 @@ version: 2 + +# Tier 1 — production ships when the floating vMAJOR tag is moved by hand +# (RELEASING.md), not when a PR merges. Consumers pin @v14 and never read +# `main`, so `main` is this repo's staging: a merge here reaches nobody. +# That is why auto-merging patch + minor onto it is safe. +# +# The release gate is therefore a human moving the tag. Worth knowing when you +# do: the `ci` check is actionlint only — it lints the YAML, it does not test +# that the reusables still work, and a bad docker-build.yml reaches every +# consumer the moment the tag moves. updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" + interval: "daily" + time: "05:00" + timezone: "Etc/UTC" open-pull-requests-limit: 10 + # A version must be 7 days old before a PR opens — supply-chain gate; most + # compromised packages are yanked within 24-72h. Version updates only: + # security updates deliberately ignore it. + cooldown: + default-days: 7 groups: github-actions-minor-patch: - update-types: ["minor", "patch"] \ No newline at end of file + update-types: ["minor", "patch"] + ignore: + # No major PRs at all. `ignore` covers version updates only, so a + # security major can still open one — the auto-merge workflow's + # update-type gate is what refuses to merge it. + - dependency-name: "*" + update-types: ["version-update:semver-major"]