jrfnl / phpcs-variable-analysis

94%

master: 93%

LAST BUILD ON BRANCH feature/ghactions-improve-pins-dependabot

branch: feature/ghactions-improve-pins-dependabot

CHANGE BRANCH

x

Reset

Sync Branches

• feature/ghactions-improve-pins-dependabot
• PULLED/CS
• feature/ghactions-do-not-persist-credentials
• feature/ghactions-minor-tweaks
• feature/switch-to-ghactions-and-coveralls
• feature/update-for-1.0-release-of-composer-phpcs-plugin

Build # 22909519175

Build Type

push

github

Committed by jrfnl

Commit Message

Dependabot: update config

:point_right: Important: this is for **version** updates only, not for security updates, which are handled separately and don't depend on this configuration.

---

This commit makes the following changes to the Dependabot config to reduce the number of Dependabot PRs, while still keeping the workflows up to date with a reasonable frequency:
* It introduces a "group".
    By default Dependabot raises individual PRs for each update. Now, it will group updates to new minor or patch release for all action runners into a single PR.
    Updates to new major releases of action runners will still be raised as individual PRs.
* It changes the schedule from `weekly` (on Monday, at whatever time this repo reaches the front of the HUGE queue which it will always have on Monday) to twice a month at a specific time which is not midnight.
    Aside from making the PRs less frequent, it should also make the arrival time more predictable as the queue created at 22:10 (in whatever timezone Dependabot runs in) will be next to nothing as it would need more repos to use this exact configuration.

Refs:
* https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates
* https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference

Run Details

1929 of 2058 relevant lines covered (93.73%)

132.91 hits per line