mirror of
https://github.com/mruby/mruby
synced 2026-06-08 16:11:16 +00:00
John Bampton
6d5de7b3c1
Enforces security best practices by requiring a minimum age for new dependency releases before they are automatically updated by Dependabot. This practice, known as a "cooldown period," helps mitigate supply chain attacks by allowing time for frequently published malicious packages to be identified. https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-
16 lines
360 B
YAML
16 lines
360 B
YAML
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: "bundler"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
cooldown:
|
|
default-days: 7
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "daily"
|
|
cooldown:
|
|
default-days: 7
|