Commit ad0ba16
authored
🩹 [Enhancement]: Update Dependabot schedule and workflow versioning (#17)
Dependabot now checks for GitHub Actions updates daily instead of
weekly, with a 7-day cooldown period that prevents noisy update
notifications for rapidly iterating dependencies. Additionally, the
Process-PSModule workflow reference is now pinned to a specific commit
SHA for improved security and reproducibility.
- Fixes #16
## Dependabot daily schedule with cooldown
The dependabot configuration has been updated to use a daily schedule
with a 7-day cooldown period. This allows the repository to receive
dependency update notifications earlier while filtering out rapid
version churns that would otherwise create unnecessary PR noise.
```yaml
schedule:
interval: daily
cooldown:
default-days: 7
```
## Workflow action version pinning
The Process-PSModule reusable workflow is now pinned to commit SHA
`7c92b2ff94b965f4eaef272c3f3e0e766cd683f2` with a version comment `#
v5.4.0`. This follows security best practices by:
- Preventing unexpected behavior from tag mutations
- Ensuring reproducible workflow runs
- Making version information visible directly in the workflow file1 parent 94e3625 commit ad0ba16
2 files changed
Lines changed: 6 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
9 | | - | |
| 8 | + | |
| 9 | + | |
10 | 10 | | |
11 | 11 | | |
12 | 12 | | |
13 | 13 | | |
14 | | - | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
27 | 27 | | |
28 | 28 | | |
29 | 29 | | |
30 | | - | |
| 30 | + | |
31 | 31 | | |
32 | 32 | | |
33 | 33 | | |
0 commit comments