fix(dependabot): set npm open-pull-requests-limit to 0#275
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
There was a problem hiding this comment.
Pull request overview
Updates the repository’s Dependabot configuration to follow the documented security-only policy for npm dependency updates by suppressing non-security version-bump PRs.
Changes:
- Set npm
open-pull-requests-limitfrom10to0in.github/dependabot.yml(security updates still bypass the limit).
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the .github/dependabot.yml configuration by setting the open-pull-requests-limit for the npm ecosystem to 0. The review feedback suggests applying this same change to the github-actions ecosystem to maintain consistency with the security-only policy across the repository.
| schedule: | ||
| interval: 'weekly' | ||
| open-pull-requests-limit: 10 | ||
| open-pull-requests-limit: 0 |
There was a problem hiding this comment.
The open-pull-requests-limit for npm is now 0, which aligns with the security-only policy mentioned in the pull request description. However, the github-actions ecosystem on line 16 still has this limit set to 10. To ensure this policy is applied consistently across all package ecosystems in this file, consider also setting the limit for github-actions to 0.
|
@dev-lead - please fix this PR |
Summary
open-pull-requests-limitfrom10to0to implement the security-only policy perstandards/dependabot-policy.md. Dependabot security updates bypass this limit, so security PRs still get created. Version-bump PRs (which don't affect application stability) are suppressed.Compliance findings addressed
wrong-limit-npmRemaining findings requiring human action
unpinned-actions-*) — requiresworkflowswrite permissionstray-codeql-workflow— deletecodeql.ymland enable GitHub default setup viaapply-repo-settings.shnon-stub-dependabot-rebase.yml— sync fromstandards/workflows/dependabot-rebase.yml(requiresworkflowspermission)allow_auto_merge,delete_branch_on_merge,check-suite-auto-trigger-*) — runbash scripts/apply-repo-settings.sh google-app-scriptsbash scripts/apply-repo-settings.sh google-app-scriptsPart of petry-projects/.github#261
Generated with Claude Code