Repository navigation
chore: add a 7-day Dependabot cooldown - #314
Conversation
zizmor flagged the shared cpp-linter/.github workflows called at @main and Dependabot updates without a cooldown. Use the same zizmor.yml as cpp-linter and cpp-linter-rs (cpp-linter/* may use any ref) and a 7-day cooldown.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #314 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 4 4
Lines 591 591
=========================================
Hits 591 591 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Dependabot cooldown settings .github/dependabot.yml |
Adds a 7-day cooldown to GitHub Actions and pip updates. |
Zizmor unpinned-use policies .github/zizmor.yml |
Sets ref-pin for actions/*, github/*, and dependabot/*, and any for cpp-linter/*. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Possibly related PRs
- cpp-linter/cpp-linter-hooks#305: Adds a publish workflow with pinned GitHub Actions, which relates to the
ref-pinpolicy configured here.
Merge Risk: 
f845d
-
The automation policy changes present no identified merge-blocking risk and are mergeable subject to normal configuration checks.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Title check The title clearly and concisely describes the documented main change: adding a 7-day Dependabot cooldown.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
|
shenxianpeng
changed the title
zizmor (offline) flagged
dependabot-cooldownon both update entries. This adds a 7-day cooldown, as in cpp-linter.The shared
cpp-linter/.github/...@mainworkflows also show up asunpinned-usesin a local zizmor run. That is expected: this repo does not run zizmor in CI, so there is no per-repo zizmor config. Recent CI runs onmainhad no warnings, and the README's hook arguments match the parsers.