mirror of
https://github.com/borgbackup/borg.git
synced 2026-09-02 14:43:21 +02:00
daa1944e74Malicious releases are usually caught and pulled within days, so waiting before adopting a new version buys herd immunity for little cost. A compromised action is the more severe case of the two we consume: it runs with the workflow token and can tamper with build artifacts before they get attested. Mirror the major/minor values already used for pip. default-days additionally covers patch releases and actions that do not use semver, which the pip block does not set. Security updates are not delayed by cooldown.
29 lines
635 B
YAML
29 lines
635 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
# default-days also covers patch releases and actions not using semver.
|
|
default-days: 14
|
|
semver-major-days: 90
|
|
semver-minor-days: 30
|
|
groups:
|
|
actions:
|
|
patterns:
|
|
- "*"
|
|
- package-ecosystem: "pip"
|
|
directory: "/requirements.d"
|
|
ignore:
|
|
- dependency-name: "black"
|
|
schedule:
|
|
interval: "weekly"
|
|
cooldown:
|
|
semver-major-days: 90
|
|
semver-minor-days: 30
|
|
groups:
|
|
pip-dependencies:
|
|
patterns:
|
|
- "*"
|
|
|