mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-23 23:41:06 +09:00
Jeremy Daer
9310b002d7
The docker block copied bundler's cooldown wholesale, but Dependabot only accepts semver-major/minor/patch-days for ecosystems whose versions it classifies as semver, and container tags aren't. One invalid property invalidates the entire file rather than the block it sits in, so since this config landed in #248 the version updater has not run for any ecosystem at all: Your .github/dependabot.yml contained invalid details The property '#/updates/2/cooldown/semver-major-days' is not supported for the package ecosystem 'docker'. (and -minor-, -patch-) That is why #249's cooldown exclude for brakeman never took effect, and why #250 had to bump the workflow linter pins by hand while every other repo got a Dependabot PR. It also left `bin/brakeman --ensure-latest 15` armed with nothing to disarm it: the lock pins brakeman 8.0.6, and CI would have gone red roughly 15 days after 8.0.7 shipped. Security updates were never affected — those don't read this file, which is why the only four Dependabot runs here are single-gem security bumps. docker keeps default-days, which is supported for every ecosystem.