[mrz1836]

Summary

Adds a Dependabot cooldown to every update entry of .github/dependabot.yml and hardens its update settings.
The repository's own files were read to find its ecosystems and the dependencies the owner's inventory exempts; the file was rewritten to the conventions and passed the deterministic checks below before this PR was opened. Only .github/dependabot.yml changes.

Changes

Ecosystem	Directory	Target branch	Change
gomod	/, examples/ws-subscribe-to-new-headers	main	+ cooldown: default 3 days; semver patch 3, minor 7, major 14
github-actions	/	main	+ cooldown: default 3 days; excludes actions/*, github/*, gitleaks/*, ossf/*
devcontainers	/	main	+ cooldown: default 3 days; excludes ghcr.io/devcontainers/features/*
docker	/	main	+ cooldown: default 3 days; excludes golang
docker-compose	/	main	+ new entry + allow: [{"dependency-type":"direct"}] + assignees: ["mrz1836"] + commit-message: {"include":"scope","prefix":"chore"} + cooldown: default 3 days + groups: docker-compose-all + labels: ["chore","dependencies","docker"] + open-pull-requests-limit: 5 + schedule: {"day":"monday","interval":"weekly","time":"10:00","timezone":"America/New_York"} + target-branch: main
docker	/release	main	+ new entry + allow: [{"dependency-type":"direct"}] + assignees: ["mrz1836"] + commit-message: {"include":"scope","prefix":"chore"} + cooldown: default 3 days; excludes golang + groups: dockerfiles-release-all + labels: ["chore","dependencies","docker"] + open-pull-requests-limit: 5 + schedule: {"day":"monday","interval":"weekly","time":"10:15","timezone":"America/New_York"} + target-branch: main

Why a cooldown

A new release must age before Dependabot proposes it: 3 days by default, and for ecosystems that follow semantic versioning 3 days for a patch, 7 for a minor and 14 for a major release.
A compromised or broken release is usually found and pulled within days; the cooldown keeps it out of this repository meanwhile (a supply-chain guard).
Security updates are not delayed: the cooldown applies to version updates only.

Excluded from the cooldown

These come from publishers the owner trusts, so their updates arrive at once:

Ecosystem	Pattern	Why	Matches
devcontainers	ghcr.io/devcontainers/features/*	trusted publisher	ghcr.io/devcontainers/features/docker-outside-of-docker, ghcr.io/devcontainers/features/github-cli
docker	golang	trusted publisher	golang
github-actions	actions/*	trusted publisher	actions/cache, actions/checkout, actions/create-github-app-token, actions/download-artifact, actions/github-script, actions/setup-go, actions/upload-artifact
github-actions	github/*	trusted publisher	github/codeql-action
github-actions	gitleaks/*	trusted publisher	gitleaks/gitleaks-action
github-actions	ossf/*	trusted publisher	ossf/scorecard-action

Notes

Added a cooldown to every update entry (3 days by default; Go modules also get patch 3 / minor 7 / major 14 days), excluding trusted publishers (actions/, github/, gitleaks/, ossf/, devcontainer features, golang images). Added entries for docker-compose.yml and release/Dockerfile, following the existing schedule, grouping, labels, assignee and commit-message conventions. The cooldown applies only to version updates, so security updates are never delayed. Note: the section 4 comment says it covers Dockerfiles in sub-directories, but Dependabot only scans the configured directory, which is why release/ needs its own entry. The new docker-compose entry reuses the existing "docker" label rather than adding a new label.

• gomod /: Added cooldown: default-days 3, semver-patch-days 3, semver-minor-days 7, semver-patch-days 3, semver-major-days 14 (Lets new module releases settle before they are proposed. Security updates are unaffected.)
• gomod /examples/ws-subscribe-to-new-headers: Covered by the same gomod entry cooldown: default-days 3, semver-patch-days 3, semver-minor-days 7, semver-major-days 14 (The example module shares the gomod entry, so it gets the same release delay.)
• github-actions /: Added cooldown: default-days 3, excluding actions/, github/, gitleaks/, ossf/ (Delays third-party action updates while trusted publishers update immediately.)
• devcontainers /: Added cooldown: default-days 3, excluding ghcr.io/devcontainers/features/* (Delays devcontainer updates except the trusted official features.)
• docker /: Added cooldown: default-days 3, excluding golang (Delays base-image updates except the trusted golang image.)
• docker-compose /: New entry: weekly Monday 10:00 America/New_York, direct deps, grouped, PR limit 5, target-branch main, cooldown default-days 3 (docker-compose.yml had no Dependabot coverage.)
• docker /release: New entry: weekly Monday 10:15 America/New_York, direct deps, grouped, PR limit 5, target-branch main, cooldown default-days 3 excluding golang (release/Dockerfile was not covered: the existing docker entry only scans the repository root.)

Checks passed

• valid YAML, one document, version: 2, only Dependabot's top-level keys
• no registries, none added; the other top-level settings unchanged
• every existing entry kept (4 of 4): its ecosystem, directories and target-branch
• the existing entries' settings unchanged: schedule, allow, ignore, labels, groups, assignees, commit-message, registries and the rest
• new entries only where the repo has the ecosystem: docker-compose / → main; docker /release → main
• target-branch is main on every entry that had none (an existing one is kept)
• only Dependabot's keys and ecosystems; insecure-external-code-execution only where supported, never newly allow
• every entry has a cooldown: default-days 3, and semver-patch-days 3, semver-minor-days 7, semver-major-days 14 where the ecosystem takes them (never shorter than the entry had, nor than its package manager's own minimum release age)
• cooldown excludes only the inventory's patterns, first-party or trusted (6 allowed)
• no two entries of one ecosystem update the same directory for the same branch
• no secret, registry or ${{ }} reference added
• only .github/dependabot.yml changes (staged and committed alone)

Test plan

• After the merge, Dependabot validates the configuration on main: check the repository's Dependabot tab (Insights → Dependency graph → Dependabot, https://github.com/bsv-blockchain/block-headers-service/network/updates) for errors.
• The next version-update PRs arrive only for releases older than their cooldown; the excluded ones at once.

---

Generated with magex dependabot:harden

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud