Skip to content

⚙️ [Maintenance]: Dependency updates run independently - #168

Merged
Marius Storhaug (MariusStorhaug) merged 3 commits into
mainfrom
remove-dependabot-grouping
Aug 9, 2026
Merged

⚙️ [Maintenance]: Dependency updates run independently#168
Marius Storhaug (MariusStorhaug) merged 3 commits into
mainfrom
remove-dependabot-grouping

Conversation

@MariusStorhaug

@MariusStorhaug Marius Storhaug (MariusStorhaug) commented Aug 9, 2026

Copy link
Copy Markdown
Member

Dependency updates now arrive as separate pull requests, making each update independently reviewable and releasable. Dependabot checks run at 09:00 Europe/Oslo on Monday, Wednesday, and Friday, and version updates wait three days after release before being proposed.

Changed: Dependency update cadence and review scope

Each dependency update now has its own pull request rather than being bundled with other minor or patch updates. This keeps release attribution and rollback scope clear for maintainers.

Version-update checks run on Monday, Wednesday, and Friday at 09:00 Europe/Oslo. A three-day cooldown remains in place before Dependabot proposes a newly published version. Security updates continue to bypass the schedule and cooldown.


Technical details
  • Removed Dependabot groups configuration for the GitHub Actions and pip ecosystems.
  • Configured the 0 9 * * 1,3,5 schedule with the Europe/Oslo timezone and a three-day default cooldown.
  • Documented narrowly scoped zizmor exceptions for the approved cooldown, which is below zizmor's default seven-day recommendation.
  • Removed grouping requirements and design guidance; updated the dependency-updates configuration surface for cron schedules.
  • Implementation plan progress: all steps in Remove Dependabot action-update grouping from the GitHub Actions standard #19 are complete.
  • Standards and framework alignment:
Changed surface Standards checked Framework docs checked Result
.github/dependabot.yml GitHub Actions Dependency Updates capability Aligned
src/docs/Coding-Standards/GitHub-Actions.md Markdown GitHub Actions standard Aligned
src/docs/Capabilities/dependency-updates/** Markdown Dependency Updates capability Aligned
Relevant issues (or links)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@MariusStorhaug Marius Storhaug (MariusStorhaug) changed the title Remove Dependabot update grouping ⚙️ [Maintenance]: Dependency updates run independently Aug 9, 2026
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@MariusStorhaug
Marius Storhaug (MariusStorhaug) marked this pull request as ready for review August 9, 2026 21:17
@MariusStorhaug
Marius Storhaug (MariusStorhaug) merged commit 14e5964 into main Aug 9, 2026
22 checks passed
@MariusStorhaug
Marius Storhaug (MariusStorhaug) deleted the remove-dependabot-grouping branch August 9, 2026 21:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release:none No release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove Dependabot action-update grouping from the GitHub Actions standard

1 participant