From 714866d3c48a865842d705230af42f523bd9aca2 Mon Sep 17 00:00:00 2001
From: Gregory Oschwald <goschwald@maxmind.com>
Date: Thu, 30 Oct 2025 14:26:36 -0700
Subject: [PATCH] Set Dependabot cooldown period to 4 days

This addresses the zizmor findings by setting a cooldown period of 4 days
for all package ecosystems in dependabot.yml.

Related to: ENG-3236
---
 .github/dependabot.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 12761c0..3f2887d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +1,17 @@
 version: 2
 updates:
   - package-ecosystem: uv
-    directory: "/"
+    directory: /
     schedule:
       interval: daily
-      time: "14:00"
+      time: '14:00'
     open-pull-requests-limit: 10
-  - package-ecosystem: "github-actions"
-    directory: "/"
+    cooldown:
+      default-days: 4
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
       interval: daily
-      time: "14:00"
+      time: '14:00'
+    cooldown:
+      default-days: 4