ci: group dependabot minor and patch updates - #2438
Merged
Merged
Conversation
12 of 32 open PRs here are dependabot bumps, one per dependency, because dependabot.yml sets no groups. Group minor and patch updates per ecosystem so they arrive as a single weekly PR, and leave majors ungrouped so they still get reviewed individually.
zizmor audits dependabot.yml and flags each update entry without a cooldown as a Medium finding, which fails the zizmor-output check. It only scans changed files, so the finding was latent until this PR touched the file. Cooldown also stands on its own: letting a release age before adopting it narrows the window in which a compromised or immediately-yanked version gets pulled in.
Dependabot's own config check rejected the file: The property '#/updates/1/cooldown/semver-major-days' is not supported for the package ecosystem 'github-actions'. (same for minor and patch) The semver-*-days breakdown is only valid for ecosystems that carry semver metadata, so github-actions keeps default-days alone. Gradle is unchanged.
dkhawk
approved these changes
Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
12 of the 32 currently open PRs in this repo are dependabot version bumps, each with its own CI run and its own merge.
.github/dependabot.ymldeclares both ecosystems but sets nogroups:, so every dependency gets a separate PR.Change
Group routine minor and patch updates into one PR per ecosystem per week. Major bumps are deliberately left ungrouped so they keep getting individual review, which is where the actual risk lives.
Expected effect: roughly 12 open bot PRs collapse to about 2 per week, one for Gradle and one for GitHub Actions.
Notes
chore(deps)commit prefix, oropen-pull-requests-limit.android-maps-composeandandroid-maps-utils, which have the same gap.Also added: dependabot cooldown
The
zizmorsecurity scan flags everyupdates:entry without acooldown:as a Medium finding, which failszizmor-output. It only audits changed files, so the finding was latent until this PR toucheddependabot.yml.Added a cooldown (7 days default, 14 for majors, 3 for patches). It also stands on its own merits: letting a release age before adopting it narrows the window in which a compromised or immediately-yanked version gets pulled in.
zizmor-outputis green with it in place.