Add cooldown to dependabot actions
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 76/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- github
- Domain
- devops
Research direction
Start by locating this repository's Dependabot configuration and compare it with the linked beeware/.github configuration. Verify how the seven-day cooldown is represented, then update the repository configuration and confirm that auditing tools no longer report the missing explicit cooldown.
Written by the indexing model from the issue text.
Description
What is the problem or limitation you are having?
Our dependabot configuration currently upgrades all packages to the most recently available versions at the time of publication. This is a potential vector for supply chain attacks, as there's no window for a malicious release to be identified before it is rolled out. Best practice is to add a cooldown period to dependency updates.
Describe the solution you'd like
We should add a 7 day cooldown to our dependabot configuration.
This has already been done to the beeware/.github dependabot configuration. We should make the analogous change to the dependabot configuration in this repository.
Describe alternatives you've considered
Dependabot recently added a default cooldown. However, the issue will still be identified by zizmor (and other auditing tools); and it's better to be explicit rather than implicit.
Additional context
- Dominant language
- Python
- Stars
- 7
- Forks
- 8
- Avg merge
- 9h 41m
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from beeware/Python-support-testbed
-
enhancement good first issue
Difficulty 4/5 3-5 days Newbie friendliness 45/100
beeware/Python-support-testbed#191 · 2 comments ·
-
enhancement good first issue
Difficulty 3/5 1-2 days Newbie friendliness 42/100
beeware/Python-support-testbed#123 · 1 comment ·
All issues in beeware/Python-support-testbed
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100