🌱 institute 2wk dependency cooldown policy

[grokspawn]

Description

Sets a policy of 14 days for all non-securty dependencies, which feels like a reasonable default for discovery of any related supply-chain attacks/mitigation.

Ref: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates#setting-up-a-cooldown-period-for-dependency-updates

Reviewer Checklist

• API Go Documentation
• Tests: Unit Tests (and E2E Tests, if appropriate)
• Comprehensive Commit Messages
• Links to related GitHub Issue(s)

[netlify]

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	bb77bba
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/69277cd3a63aff000740c0ca
😎 Deploy Preview	https://deploy-preview-2363--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

This PR attempts to introduce a 14-day cooldown policy for Dependabot dependency updates across all package ecosystems (GitHub Actions, Go modules, and pip) to provide a buffer period for detecting supply-chain attacks. However, the cooldown configuration field used is not a valid Dependabot configuration option and will be ignored by Dependabot, meaning the intended functionality will not work.

Key Changes:

• Added cooldown.default-days: 14 configuration to three package ecosystem entries in Dependabot configuration

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[rashmigottipati]

(optional nit): how about adding a brief note to CONTRIBUTING.md doc mentioning the new dependabot cooldown policy?

/lgtm

[grokspawn]

/override experimental-e2e
/approve

[openshift-ci]

@grokspawn: Overrode contexts on behalf of grokspawn: experimental-e2e

Details

In response to this:

/override experimental-e2e
/approve

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[oceanc80]

/approve

[jianzhangbjz]

However, the cooldown configuration field used is not a valid Dependabot configuration option and will be ignored by Dependabot, meaning the intended functionality will not work.

Not sure why the Copilot points out this warning. Based on https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-, it should work.

[jianzhangbjz]

/retest-required

[jianzhangbjz]

/retest

[tmshort]

Copilot is saying this won't work? Is it's info out-of-date?

[tmshort]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: grokspawn, oceanc80, rashmigottipati, tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• .github/OWNERS [tmshort]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.53%. Comparing base (045989d) to head (bb77bba).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@## main #2363 +/- ##
==========================================
- Coverage 74.39% 70.53% -3.87% 
==========================================
Files 93 93 Lines 7300 7300 ==========================================
- Hits 5431 5149 -282 - Misses 1435 1718 +283 + Partials 434 433 -1 

Flag	Coverage Δ
e2e	44.53% <ø> (ø)
experimental-e2e	14.06% <ø> (-34.67%)	⬇️
unit	58.47% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.