Skip to content

ci: note that Dependabot security PRs skip the release-age cooldown #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rqbazan merged 1 commit into from
Oct 18, 2026
Merged

ci: note that Dependabot security PRs skip the release-age cooldown #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
# Dependabot security updates only. Version updates stay manual: open-pull-requests-limit: 0
# turns them off, while security updates still open PRs for every new alert.
# cooldown mirrors pnpm's minimumReleaseAge (24 h). GitHub applies it to version updates only,
# so it does not delay security PRs: check the fixed version's age before merging one.
# Dependabot security updates only. open-pull-requests-limit: 0 turns version updates off; security
# updates, once enabled in the repo's code security settings, open a PR for each new alert.
# cooldown mirrors pnpm's minimumReleaseAge (24 h), but it only delays version updates. Security PRs
# skip both: GitHub ignores cooldown for them, and Dependabot runs pnpm with
# --config.minimumReleaseAge=0 (dependabot-core#15170). Check the fixed version's age before merging.
version: 2
updates:
- package-ecosystem: npm
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ New dependency versions must be at least 24 h old before they get in. Most malic

The same flag works with `npm update`. Then run `mise run check-dist` and commit the rebuilt `dist/` together with the lockfile.
- **Global npm CLI** in `setup-pnpm` and `setup-pnpm-bun`: an exact version, bumped by hand to a release at least 24 h old (see the comment on the "Update npm" step). Both actions are deprecated in favor of mise, which uses the npm bundled with the locked Node.
- **Security updates**: Dependabot ([`dependabot.yml`](./.github/dependabot.yml)) opens a PR for every new security alert in the root and in each action (version updates stay manual), and [`Dependency audit`](./.github/workflows/dependency-audit.yml) audits every lockfile each Monday, keeping an issue open while advisories remain. Dependabot does not rebuild `dist/`: on its PRs for an action, `Check actions dist sync` fails until someone runs `mise run check-dist` on the branch and pushes the rebuilt `dist/`.
- **Security updates**: once security updates are enabled in the repo settings, Dependabot ([`dependabot.yml`](./.github/dependabot.yml)) opens a PR for every new security alert in the root and in each action (version updates stay manual), and [`Dependency audit`](./.github/workflows/dependency-audit.yml) audits every lockfile each Monday, keeping an issue open while advisories remain. Dependabot does not rebuild `dist/`: on its PRs for an action, `Check actions dist sync` fails until someone runs `mise run check-dist` on the branch and pushes the rebuilt `dist/`. Its PRs also skip the 24 h cooldown (GitHub ignores `cooldown` for security updates, and Dependabot runs pnpm with `minimumReleaseAge=0`), so check the fixed version's publish date before merging one.

## Security linting

Expand Down
Loading