🌱 institute 2wk dependency cooldown policy #2363
Conversation
Signed-off-by: grokspawn <jordan@nimblewidget.com>
✅ Deploy Preview for olmv1 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR attempts to introduce a 14-day cooldown policy for Dependabot dependency updates across all package ecosystems (GitHub Actions, Go modules, and pip) to provide a buffer period for detecting supply-chain attacks. However, the cooldown configuration field used is not a valid Dependabot configuration option and will be ignored by Dependabot, meaning the intended functionality will not work.
Key Changes:
- Added
cooldown.default-days: 14configuration to three package ecosystem entries in Dependabot configuration
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
rashmigottipati
left a comment
rashmigottipati
left a comment
There was a problem hiding this comment.
(optional nit): how about adding a brief note to CONTRIBUTING.md doc mentioning the new dependabot cooldown policy?
/lgtm
|
/override experimental-e2e |
|
@grokspawn: Overrode contexts on behalf of grokspawn: experimental-e2e In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Not sure why the Copilot points out this warning. Based on https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-, it should work. |
|
/retest-required |
|
/retest |
|
Copilot is saying this won't work? Is it's info out-of-date? |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: grokspawn, oceanc80, rashmigottipati, tmshort The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
openshift-merge-bot
bot
merged commit b23e124
into
operator-framework:main
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2363 +/- ##
==========================================
- Coverage 74.39% 70.53% -3.87%
==========================================
Files 93 93
Lines 7300 7300
==========================================
- Hits 5431 5149 -282
- Misses 1435 1718 +283
+ Partials 434 433 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
5 participants
Description
Sets a policy of 14 days for all non-securty dependencies, which feels like a reasonable default for discovery of any related supply-chain attacks/mitigation.
Ref: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates#setting-up-a-cooldown-period-for-dependency-updates
Reviewer Checklist