From 8700d79b0f95f47e003ba8a8fdb99294e52a9cf0 Mon Sep 17 00:00:00 2001
From: hatisuka <74543106+hatisuka@users.noreply.github.com>
Date: Mon, 26 Oct 2026 12:21:40 +0900
Subject: [PATCH] =?UTF-8?q?chore:=20Dependabot/Renovate=20=E3=81=AE=20cool?=
 =?UTF-8?q?down=20=E3=82=9210=E6=97=A5=E3=81=AB=E7=B5=B1=E4=B8=80=E3=81=99?=
 =?UTF-8?q?=E3=82=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

サプライチェーン攻撃対策として公開10日未満のバージョンを取り込まない。
全社で Dependabot は daily / open-pull-requests-limit 10 / cooldown 10日、
Renovate は minimumReleaseAge 10日に統一する。

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index da059f2..3e0be03 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,10 +4,12 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
-      day: "monday"
+      interval: "daily"
       time: "10:00"
       timezone: "Asia/Tokyo"
+    cooldown:
+      default-days: 10
+    open-pull-requests-limit: 10
     groups:
       github-actions:
         patterns: