19595761232
95%
master: 95%

Ran 22 Nov 2025 12:57PM UTC

Jobs 1

Files 5

Run time 1min

Badge

Embed ▾

Committed 22 Nov 2025 12:46PM UTC coverage: 94.678%. Remained the same

Build # 19595761232

Build Type

Pull #305

github

Committed by

cljoly

Commit Message

ci: introduce dependency cool down

Supply chain attacks have become quite common recently. To limit this
risk, [one simple idea](https://lobste.rs/s/rygog1/) is to have a
cool down period, where new dependencies are not merged. While I review
the changes made in a version, it’s possible I miss something and merge
a vulnerable version. So let’s be a bit more cautious moving forward.

Note that this only applies to updates that are not security fixes:

> The cooldown option is only available for version updates, not security updates.

[GitHub docs](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference?versionId=free-pro-team%40latest&productId=code-security&restPage=dependabot#cooldown-)

While we are at it, remove the deps.rs badge. This is often broken,
displaying “depenencies unknown” and when it does work, it will say that
depenencies are out of date for longer because of the cooldown period.

Having a badge always green at the expense of a higher supply chain risk
is not the right tradeoff at this point.

Pull Request Pull Request #305: ci: introduce dependency cool down

Run Details

338 of 357 relevant lines covered (94.68%)

5.1 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	19595761232.1	22 Nov 2025 12:57PM UTC	5	94.68	GitHub Action Run

cljoly / rusqlite_migration / 19595761232
95%
master: 95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 19595761232

cljoly / rusqlite_migration / 19595761232 95% master: 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 19595761232

cljoly / rusqlite_migration / 19595761232
95%
master: 95%

README BADGES
x