diff options
| -rw-r--r-- | .github/dependabot.yml | 10 | ||||
| -rw-r--r-- | .github/workflows/ci.yml | 8 | ||||
| -rw-r--r-- | .github/workflows/maintenance.yml | 3 |
3 files changed, 21 insertions, 0 deletions
diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2bcf95d..3c868bb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,20 +5,28 @@ updates: - '**/*' schedule: interval: weekly + cooldown: + default-days: 7 - package-ecosystem: docker-compose directories: - '**/*' schedule: interval: weekly + cooldown: + default-days: 7 - package-ecosystem: github-actions directory: / schedule: interval: weekly + cooldown: + default-days: 7 - package-ecosystem: gitsubmodule directories: - '**/*' schedule: interval: weekly + cooldown: + default-days: 7 - package-ecosystem: pip directory: / schedule: @@ -27,3 +35,5 @@ updates: # The idea is that hopefully, it'll minimize the number of PRs I get for # minor dependencies in requirements.txt. cronjob: '30 04 * * 5' + cooldown: + default-days: 7 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7d93ee1..34f6dbe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,8 @@ on: - '*.md' workflow_dispatch: +permissions: {} + jobs: lint: runs-on: ubuntu-latest @@ -14,6 +16,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Python uses: actions/setup-python@v7 with: @@ -43,6 +47,7 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 + persist-credentials: false submodules: recursive - name: Set up Python uses: actions/setup-python@v7 @@ -63,6 +68,7 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - name: Integration test (Docker) run: sudo make test/docker @@ -84,6 +90,7 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false submodules: recursive - name: Set up Python uses: actions/setup-python@v7 @@ -176,6 +183,7 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 + persist-credentials: false submodules: recursive - name: Set up Python uses: actions/setup-python@v7 diff --git a/.github/workflows/maintenance.yml b/.github/workflows/maintenance.yml index 07e2267..2dc3d71 100644 --- a/.github/workflows/maintenance.yml +++ b/.github/workflows/maintenance.yml @@ -7,6 +7,8 @@ on: - cron: '30 02 * * 5' workflow_dispatch: +permissions: {} + jobs: maintenance: runs-on: ubuntu-latest @@ -15,6 +17,7 @@ jobs: - name: Checkout uses: actions/checkout@v7 with: + persist-credentials: false # I think that by default, pushes don't trigger other workflows, and # you need a separate token for that: # https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow |