fix: use the cooldown key actions accepts

[michen00]

Summary

Replaces semver-major-days with default-days on the github-actions ecosystem, because that ecosystem does not accept the semver-* keys and the failure is silent and total rather than partial.

GitHub rejects semver-major-days for github-actions with "not supported for the package ecosystem 'github-actions'", and the options reference confirms it: default-days is supported for every package manager, while semver-major-days, semver-minor-days and semver-patch-days are supported only for the ecosystems it lists, and github-actions is not among them. An invalid key does not degrade to "cooldown ignored" — it invalidates the file and drops the whole github-actions entry, grouping and ignore rules included. So a key added to introduce a soak period removes the grouping instead, and the visible symptom is one pull request per action rather than one per group.

This is a self-inflicted regression and worth saying so plainly: the invalid key arrived in the pull request that standardized this workflow, and it merged because the check-dependabot pre-commit hook passes on it. That hook validates against the published schema, and the schema admits semver-major-days in a cooldown block generally — the ecosystem restriction is enforced server-side, so no local gate can catch it. A sibling repository had already hit this and recorded the diagnosis in its own config; that comment is where this fix came from.

One number therefore has to cover every actions update. 30 days rather than something shorter, because bot-automerge.yml now arms github-actions majors instead of holding them — this delay is the only soak period between a release being published and it merging here unattended. A patch is not safer than a major when the risk is a compromised publisher rather than a changed interface, and these packages execute with this repository's own token inside jobs holding write scopes.

A review on this pull request raised two further things, both acted on in a follow-up commit. The workflow comment still described a "30-day major cooldown", which stopped being true the moment the key changed — the one place a reader is told how the arming policy and the cooldown fit together was describing a key that is not there. And the effective delay is longer than the number: this ecosystem is polled on the 1st and 15th, so an update whose cooldown expires just after a poll waits for the next one, putting a pull request roughly 30–45 days after the release rather than 30. That is recorded rather than retuned, because shortening the cooldown to compensate would couple two independent settings and the drift is in the safe direction.

Test plan

• Confirmed against GitHub's own options reference that github-actions supports default-days only
• Audited every sibling repository for the same key, so this is fixed across the set rather than here alone
• pre-commit run --files .github/dependabot.yml passes — noted above as insufficient, and recorded here because passing is exactly what made this reachable
• The commit carries a verified signature
• actionlint and yamllint clean on the workflow comment change
• CI is green — pending on this head
• The real confirmation is the next github-actions pull request arriving grouped. That cannot be observed before merge, and it is the check to make afterwards: one grouped pull request means the entry is being read, several ungrouped ones mean it is still being dropped.

Reviewer guide

• Effort: ~2 minutes. One key renamed and one value changed; the rest is the comment explaining why.
• The calls only you can make: whether 30 days is the right single delay now that one number has to serve every actions update. The alternative is a short delay accepting that majors merge quickly, or reverting to a blanket major hold in the workflow and a short cooldown here. 30 was chosen because majors now arm unattended.
• Known weaknesses: nothing local can catch a recurrence. The schema hook admits the invalid key and the rejection only appears server-side, in the Dependabot tab, as a config error on a file that otherwise looks fine.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[qodo-code-review]

PR Summary by Qodo

Fix Dependabot cooldown key for github-actions ecosystem

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Replace invalid github-actions cooldown key to prevent Dependabot silently dropping the ecosystem
 config
• Restore intended grouping/ignore behavior by using supported cooldown configuration
• Document server-side validation caveat and rationale for 30-day soak period

Diagram

graph TD
  A[".github/dependabot.yml"] --> B["GitHub Dependabot"] --> C["Server-side option validation"] --> D["Grouped Actions PRs"]

Loading

High-Level Assessment

The PR’s approach is the correct fix: github-actions does not support semver-* cooldown keys, so switching to default-days is required to keep the ecosystem entry valid and preserve grouping/ignore rules. Alternative mechanisms (e.g., ignoring majors or limiting PRs) don’t address the root cause: server-side rejection of an unsupported key that drops the entire github-actions configuration.

Files changed (1) +14 / -2

Other (1) +14 / -2

dependabot.ymlUse supported cooldown key for github-actions and document why +14/-2

Use supported cooldown key for github-actions and document why

• Replaces an unsupported github-actions cooldown option (semver-major-days) with default-days to avoid GitHub rejecting the entire github-actions entry. Adds an explanatory comment documenting the server-side validation behavior and the rationale for a 30-day soak period.

.github/dependabot.yml

[Copilot]

Pull request overview

Updates the Dependabot configuration for the github-actions ecosystem to use a supported cooldown key so that the entire github-actions update entry (including grouping rules) is not silently dropped by GitHub.

Changes:

• Replaces an unsupported semver-major-days cooldown key with default-days for github-actions.
• Increases the cooldown to 30 days to provide a single soak period for all GitHub Actions updates.
• Adds an explanatory comment documenting the server-side validation behavior and why local schema validation doesn’t catch it.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Cooldown comment now wrong ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

This PR changes the github-actions cooldown to default-days: 30 (applies to all updates), but
bot-automerge.yml still documents it as a “30-day major cooldown.” This documentation drift can
mislead future maintenance of the automerge/cooldown policy coupling.

Code

.github/dependabot.yml[38]

+      default-days: 30

Evidence

Dependabot’s github-actions config now contains only default-days: 30, which applies broadly
rather than only to semver majors. The bot-automerge workflow comment explicitly calls the cooldown
“major”, which no longer matches the configuration.

.github/dependabot.yml[16-38]
.github/workflows/bot-automerge.yml[259-268]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Dependabot’s github-actions cooldown is now configured via `default-days: 30` (not a major-only cooldown), but `.github/workflows/bot-automerge.yml` still refers to it as a “30-day major cooldown”. This is now inaccurate documentation.

## Issue Context
The cooldown change is intentional, but the workflow comment should reflect the new semantics to avoid confusion.

## Fix Focus Areas
- .github/workflows/bot-automerge.yml[259-268]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}