Skip to content

ci: add Dependabot for GitHub Actions pins - #1133

Open
LukasParke wants to merge 1 commit into
mainfrom
chore/dependabot-actions
Open

LukasParke wants to merge 1 commit into
mainfrom
chore/dependabot-actions

Conversation

@LukasParke

@LukasParke LukasParke commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

Adds .github/dependabot.yml so the commit-SHA action pins stay current. Dependabot updates both the SHA and its # vX.Y.Z comment.

  • Ecosystem: github-actions only. Covers .github/workflows/, plus any composite actions under .github/actions/.
  • Schedule: weekly, with all bumps grouped into one PR.
  • Cooldown: 7 days, so a release has to be public for a week before we pin it. This gives time for a compromised or bad release to be caught and pulled. Security updates skip the cooldown.
  • Not auto-merged: the existing auto-merge workflows only match Speakeasy regen branches (speakeasy-sdk-regen-*) or the docs-sync app, so Dependabot PRs still get reviewed by a person.

🤖 Generated with Claude Code


Devin Review

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

Devin Review

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant