security: Delay dependabot updates [TAROT-3707]#354
Conversation
7 days should be enough when most malicious packages are patched within 24 hours.
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The pull request is currently invalid and should not be merged. While the intent to delay updates for security reasons is sound, the implementation uses a cooldown property that is not supported by the GitHub Dependabot v2 schema.
According to the analysis, this configuration will cause Dependabot to fail validation or ignore the settings entirely. Consequently, the acceptance criteria for delaying both github-actions and pip updates are not met. There is no native 'delay' or 'quarantine' feature in Dependabot; alternative approaches such as manual management or ignore conditions must be used instead.
About this PR
- The proposed implementation relies on a configuration key (
cooldown) that does not exist in the official GitHub Dependabot specification. There is currently no native way to delay updates by a fixed number of days within thedependabot.ymlfile.
Test suggestions
- Verify the .github/dependabot.yml file against the official GitHub Dependabot JSON schema.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify the .github/dependabot.yml file against the official GitHub Dependabot JSON schema.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
afsmeira
changed the title
2 participants
7 days should be enough when most malicious packages are patched within 24 hours.