From f449e90880e97a4574c5a4bfb22531db2bb0aa69 Mon Sep 17 00:00:00 2001
From: coela-oss <147021942+coela-oss@users.noreply.github.com>
Date: Fri, 16 Oct 2026 03:03:18 +0000
Subject: [PATCH] ci: use repository-owned daily Dependabot updates

---
 .github/dependabot.yml     | 9 +++------
 docs/dependency-updates.md | 2 +-
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8064f55..dec30dd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,8 +4,7 @@ updates:
   directories:
   - /
   schedule:
-    interval: weekly
-    day: wednesday
+    interval: daily
     time: '05:00'
     timezone: Asia/Tokyo
   open-pull-requests-limit: 10
@@ -20,8 +19,7 @@ updates:
   directories:
   - /.github/policy
   schedule:
-    interval: weekly
-    day: wednesday
+    interval: daily
     time: '05:00'
     timezone: Asia/Tokyo
   open-pull-requests-limit: 10
@@ -36,8 +34,7 @@ updates:
   directories:
   - /
   schedule:
-    interval: weekly
-    day: wednesday
+    interval: daily
     time: '05:00'
     timezone: Asia/Tokyo
   open-pull-requests-limit: 10
diff --git a/docs/dependency-updates.md b/docs/dependency-updates.md
index 6b989ed..ddb2e27 100644
--- a/docs/dependency-updates.md
+++ b/docs/dependency-updates.md
@@ -1,5 +1,5 @@
 # Independent dependency updates
 
-Install from the public registry using the repository manifest and lockfile. Dependabot proposes weekly manifest, lockfile and Action updates. Review and run this repository's CI before merging; major versions remain separate PRs. Update PRs replace duplicate update-tracking Issues. Do not use a neighboring checkout or a private artifact registry as the installation path.
+Install from the public registry using the repository manifest and lockfile. Dependabot checks for manifest, lockfile and Action updates daily on weekdays and proposes pull requests. Review and run this repository's CI before merging; major versions remain separate PRs. Update PRs replace duplicate update-tracking Issues. Do not use a neighboring checkout or a private artifact registry as the installation path.
 
 A lockfile records one tested resolution and is updated by the PR. It does not require users to keep installing an obsolete version named in a README. Private Git dependencies still require an explicitly configured read-only route; Dependabot is not given a copied local credential. Toolchains remain declared by the repository.