Copilot commented on code in PR #96:
URL: https://github.com/apache/arrow-erlang/pull/96#discussion_r3527863184
##########
.github/workflows/asf-allowlist-check.yml:
##########
@@ -45,3 +45,15 @@ jobs:
# Check that actions are pinned and on the ASF allowlist.
# Intentionally unpinned to always use the latest allowlist from the ASF.
- uses: apache/infrastructure-actions/allowlist-check@main # zizmor:
ignore[unpinned-uses]
Review Comment:
The `allowlist` job’s `actions/checkout` step does not set
`persist-credentials: false` (unlike the other workflows/jobs updated in this
PR). This leaves the default behavior enabled (persisting the token in the
local git config), which is exactly the class of issue Zizmor flags. Add `with:
persist-credentials: false` to this checkout step for consistent hardening.
##########
.github/dependabot.yml:
##########
@@ -24,10 +24,14 @@ updates:
commit-message:
prefix: "chore: "
open-pull-requests-limit: 10
+ cooldown:
+ default-days: 7
Review Comment:
The `cooldown` key is not part of the Dependabot version updates
configuration schema (as documented in GitHub’s Dependabot config, at least up
to Aug 2025). If unsupported, this will cause Dependabot config validation to
fail and stop updates entirely. If the goal is to reduce PR frequency, prefer
supported options like adjusting `schedule.interval` (e.g., weekly), using
`groups` to batch updates, or fine-tuning `ignore` rules.
##########
.github/dependabot.yml:
##########
@@ -24,10 +24,14 @@ updates:
commit-message:
prefix: "chore: "
open-pull-requests-limit: 10
+ cooldown:
+ default-days: 7
- package-ecosystem: "cargo"
directory: "/native/arrow_format_nif"
schedule:
interval: "daily"
commit-message:
prefix: "chore: "
open-pull-requests-limit: 10
+ cooldown:
+ default-days: 7
Review Comment:
The `cooldown` key is not part of the Dependabot version updates
configuration schema (as documented in GitHub’s Dependabot config, at least up
to Aug 2025). If unsupported, this will cause Dependabot config validation to
fail and stop updates entirely. If the goal is to reduce PR frequency, prefer
supported options like adjusting `schedule.interval` (e.g., weekly), using
`groups` to batch updates, or fine-tuning `ignore` rules.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
