From acb8d6c49453b58b36f25231c44f31ca63bb0a4a Mon Sep 17 00:00:00 2001 From: Roman Inflianskas Date: Fri, 31 Jul 2026 08:26:58 +0000 Subject: [PATCH] ci: give Dependabot Actions bumps a 7-day cooldown Pinning actions to SHAs stops a tag from being moved under us, but it does not cover the moment we adopt a new SHA. A bump PR runs the new action's code on CI before anyone reads the diff, and because every path filter in ci.yml folds in `.github/workflows/**`, such a PR trips the `heavy` filter and reaches the self-hosted GPU lanes. Those runners persist caches and build state across jobs, so anything that executes there outlives the run. GitHub already delays version updates by 3 days; published action compromises have gone unnoticed for longer, so wait 7. Cooldown applies to version updates only, so security updates still land immediately. Signed-off-by: Roman Inflianskas --- .github/dependabot.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1775cf08..7b11e837 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -8,6 +8,17 @@ updates: directory: / schedule: interval: weekly + # Wait out the window in which a compromised release is typically found and + # yanked before adopting it. Bumping a pinned SHA is the one moment the pin + # stops protecting us: the bump PR itself runs the new action's code on CI — + # including the self-hosted GPU lanes, which every Dependabot PR reaches + # because each path filter in ci.yml folds in `.github/workflows/**` — before + # a human has read the diff. Those runners keep state across jobs, so the + # blast radius outlives the run. GitHub already applies 3 days by default; + # published Actions compromises have gone unnoticed for longer than that, so + # widen it. Cooldown delays only version updates, never security updates. + cooldown: + default-days: 7 groups: github-actions: patterns: