mirror of
https://github.com/instaloader/instaloader.git
synced 2026-10-16 13:48:03 -07:00
Andreas FehlnerandAlexander Graf
1e58dddb1f
## What this changes This PR adds Dependabot configuration and hardens GitHub Actions checkout behavior. ## Dependabot - adds .github/dependabot.yml - enables grouped dependency updates - schedules updates monthly - configures a 7-day cooldown to avoid rapid follow-up bumps - includes GitHub Actions updates Configured update scopes: - pip in / - github-actions in / ## GitHub Actions hardening Sets persist-credentials: false for ctions/checkout@v4 in: - .github/workflows/windows_exe.yml - .github/workflows/packages.yml - .github/workflows/lint.yml - .github/workflows/documentation.yml ## Why - grouped updates reduce PR noise - monthly cadence is lower maintenance - cooldown helps avoid update churn - disabling persisted checkout credentials follows least-privilege CI practices --------- Co-authored-by: Alexander Graf <17130992+aandergr@users.noreply.github.com>
16 lines
272 B
YAML
16 lines
272 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: pip
|
|
directory: "/"
|
|
schedule:
|
|
interval: monthly
|
|
cooldown:
|
|
default-days: 7
|
|
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: monthly
|
|
cooldown:
|
|
default-days: 7
|