Repository navigation
set up zizmor - #577
set up zizmor#577mdaniels5757 wants to merge 6 commits into
Conversation
| rules: | ||
| dependabot-cooldown: | ||
| config: | ||
| days: 3 |
There was a problem hiding this comment.
I know this is dependabot's default, but given that zizmor recommends its own default of seven days, what's the thinking behind setting this explicitly?
There was a problem hiding this comment.
It mostly doesn't matter now that I've switched dependabot to run semi-annually. My thinking was that the cost-benefit of "will this unduly delay a needed (possibly security) update" and "will this allow a compromised upstream through?" is not favorable to longer cooldowns for nix flake (and especially nixpkgs) updates.
There was a problem hiding this comment.
Hmm, I checked out this branch and nix flake check doesn't complain about the mismatch between the 3 here and the 7 in dependabot.yml. Nor does nix fmt alter dependabot.yml. I bumped the dependabot.yml values down to 2, in case it's a greater-than-or-equal thing, and still no complaints or changes. The treefmt-nix integration should make at least one of these things happen, right?
Tested on my fork: https://github.com/mdaniels5757/nixpkgs-update/actions/runs/38155947083, https://github.com/mdaniels5757/nixpkgs-update/actions/runs/38156254605
Stack created with GitHub Stacks CLI • Give Feedback 💬