Thanks for this, though I worry about Dependabot adding too much noise, I'll change the interval if that becomes a problem.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.45%. Comparing base (37e1b34) to head (770ec46).
⚠️ Report is 2 commits behind head on main.

@@           Coverage Diff           @@
##             main     #169   +/-   ##
=======================================
  Coverage   83.45%   83.45%           
=======================================
  Files          31       31           
  Lines        7423     7423           
=======================================
  Hits         6195     6195           
  Misses       1228     1228           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

A few saved replies that I sometimes use...

• https://github.com/settings/replies

GitHub Actions are only used at CI test-time, while most other dependencies are also used at runtime. This means that if the CI tests pass, maintainers have more confidence that the proposed changes will not break runtime.

GitHub Actions have very infrequent major version changes . setup-python, the most frequent, has only had five major upgrades in its lifetime.

When GitHub Actions are upgraded, it often happens in batches. The pattern: * proposed in this PR will consolidate all GHA updates into a single pull request, further reducing chattiness.

There is a tradeoff between supply chain security and chattiness. Given that we have a few GHAs that are updated rarely and usually in batches, and we are using pattern: * to ensure that there will only ever be a single GHA upgrade PR at a time.

Thanks for the review. The interval options are daily, weekly, or monthly (not quarterly).

GitHub Actions have very infrequent major version changes. setup-python, the most frequent, has only had five major upgrades in its lifetime. Also, when they are upgraded, it often happens in batches. The pattern: * will consolidate all GHA updates into a single pull request, further reducing chattiness. See: rapidfuzz/RapidFuzz#362

There is a tradeoff between supply chain security and chattiness. Given that we have a few GHAs that are updated rarely and usually in batches and we are using pattern: * to ensure that there will only ever be a single GHA upgrade PR at a time, my recommendation would be to kick off this process in weekly mode. It is trivial it switch to monthly mode if we sense it becomes chatty. I doubt that it will.

A few saved replies that I sometimes use...

* https://github.com/settings/replies

Good pointing that out, the quick verbose reply was very conspicuous. That URL is for the local account, it doesn't show your own replies to others. Might be a good idea to disclaim quick replies so that they're not mistaken for an LLM or something.

The interval options are daily, weekly, or monthly (not quarterly).

This is inaccurate compared to the documentation you've provided. There are several more options including quarterly.
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#interval

Generated:

• Bump the github-actions group with 6 updates #170