From 0733cb15be86485853b960aeba6dc221be9d31dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C4=81ris=20Pop=C4=93ns?= <maris@popens.lv>
Date: Thu, 24 Sep 2026 14:49:22 +0300
Subject: [PATCH] Update dependabot configuration for actions

Add cooldown period for GitHub Actions updates
---
 .github/dependabot.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9017dbb..bde7079 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,12 +1,13 @@
 version: 2
 updates:
-  # The only dependencies this repo has are the actions pinned in
-  # .github/workflows/. Grouped into one PR so related bumps land together
-  # rather than as a stream; CI + dependabot-auto-merge.yml handle the rest.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    # Only offer releases at least a week old, so a hijacked or broken
+    # release is usually pulled before it lands.
+    cooldown:
+      default-days: 7
     groups:
       actions:
         patterns: ["*"]