From 3475017c18c24a15d4bb6a626a075bb31cb87767 Mon Sep 17 00:00:00 2001 From: Conduction Release Bot Date: Sun, 30 Aug 2026 18:49:21 +0200 Subject: [PATCH] fix(dependabot): aim main's config at development The default branch is moving to `main` for every app in the fleet, and Dependabot reads its config from the DEFAULT branch only. Without this, the flip would send every bump to `main` where branch-protection refuses it -- the 41-pull-request trap measured across ten other apps on 2026-08-30. Same content as the development-side change, carried onto main so the flip is safe in either order. --- .github/dependabot.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 06424bd0..c0c78fc9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,7 +9,23 @@ updates: day: saturday time: "03:00" timezone: Europe/Paris + target-branch: "development" open-pull-requests-limit: 10 + # The composer entry existed but carried NO cooldown, so PHP dependencies + # updated the moment they were published — which is exactly the window in + # which a compromised release is still on the registry. Two days is the + # floor gate-93 enforces. + # + # conduction/* is excluded on purpose: a cooldown protects against a + # compromised UPSTREAM release, and those come from this fleet's own CI. + # Delaying them would only slow the loop between a fix being released and + # arriving here. + cooldown: + default-days: 2 + include: + - "*" + exclude: + - "conduction/*" - package-ecosystem: npm directory: "/" schedule: @@ -17,6 +33,7 @@ updates: day: saturday time: "03:00" timezone: Europe/Paris + target-branch: "development" open-pull-requests-limit: 10 cooldown: default-days: 1