[mrz1836]

Summary

Adds a Dependabot cooldown to every update entry of .github/dependabot.yml and hardens its update settings.
The repository's own files were read to find its ecosystems and the dependencies the owner's inventory exempts; the file was rewritten to the conventions and passed the deterministic checks below before this PR was opened. Only .github/dependabot.yml changes.

Changes

Ecosystem	Directory	Target branch	Change
gomod	/	master	+ cooldown: default 3 days; semver patch 3, minor 7, major 14; excludes github.com/mrz1836/*
github-actions	/	master	+ cooldown: default 3 days; excludes actions/*, github/*, gitleaks/*, ossf/*
devcontainers	/	master	+ cooldown: default 3 days; excludes ghcr.io/devcontainers/features/*

Why a cooldown

A new release must age before Dependabot proposes it: 3 days by default, and for ecosystems that follow semantic versioning 3 days for a patch, 7 for a minor and 14 for a major release.
A compromised or broken release is usually found and pulled within days; the cooldown keeps it out of this repository meanwhile (a supply-chain guard).
Security updates are not delayed: the cooldown applies to version updates only.

Excluded from the cooldown

These come from the owner's own accounts (mrz1836) and from publishers the owner trusts, so their updates arrive at once:

Ecosystem	Pattern	Why	Matches
devcontainers	ghcr.io/devcontainers/features/*	trusted publisher	ghcr.io/devcontainers/features/docker-outside-of-docker, ghcr.io/devcontainers/features/github-cli
github-actions	actions/*	trusted publisher	actions/cache, actions/checkout, actions/create-github-app-token, actions/github-script, actions/upload-artifact
github-actions	github/*	trusted publisher	github/codeql-action
github-actions	gitleaks/*	trusted publisher	gitleaks/gitleaks-action
github-actions	ossf/*	trusted publisher	ossf/scorecard-action
gomod	github.com/mrz1836/*	first-party: mrz1836	github.com/mrz1836/postmark

Notes

Added a cooldown to all three existing entries (gomod, github-actions, devcontainers), each targeting master. The cooldown is 3 days by default, and gomod also gets semver patch/minor/major delays of 3/7/14 days. Each entry's exclude lists only the owner's first-party or trusted-publisher patterns for that ecosystem. Every other setting, comment and the YAML style are unchanged, and the header now describes the cooldown. Security updates are not delayed by the cooldown. One existing mismatch was left untouched: the header's 'PR limit = 10' line doesn't match the devcontainers entry's limit of 5.

• gomod /: Added cooldown: default-days 3, semver-patch-days 3, semver-minor-days 7, semver-major-days 14, exclude ["github.com/mrz1836/*"]. (Waiting a few days before taking new releases lowers the risk of pulling in a compromised or broken version, with longer waits for larger semver jumps. The owner's own modules are excluded so first-party updates land right away.)
• github-actions /: Added cooldown: default-days 3, exclude ["actions/", "github/", "gitleaks/", "ossf/"]. (github-actions takes only default-days. The 3-day wait guards against a malicious or broken action release, while trusted publishers are excluded and keep updating promptly.)
• devcontainers /: Added cooldown: default-days 3, exclude ["ghcr.io/devcontainers/features/*"]. (devcontainers takes only default-days. The wait delays untested base-image and feature releases, while the trusted official devcontainers features are excluded.)

Checks passed

• valid YAML, one document, version: 2, only Dependabot's top-level keys
• no registries, none added; the other top-level settings unchanged
• every existing entry kept (3 of 3): its ecosystem, directories and target-branch
• the existing entries' settings unchanged: schedule, allow, ignore, labels, groups, assignees, commit-message, registries and the rest
• no new entry
• target-branch is master on every entry that had none (an existing one is kept)
• only Dependabot's keys and ecosystems; insecure-external-code-execution only where supported, never newly allow
• every entry has a cooldown: default-days 3, and semver-patch-days 3, semver-minor-days 7, semver-major-days 14 where the ecosystem takes them
• cooldown excludes only the inventory's patterns, first-party or trusted (6 allowed)
• no two entries of one ecosystem update the same directory for the same branch
• no secret, registry or ${{ }} reference added
• only .github/dependabot.yml changes (staged and committed alone)

Test plan

• After the merge, Dependabot validates the configuration on master: check the repository's Dependabot tab (Insights → Dependency graph → Dependabot, https://github.com/mrz1836/go-mail/network/updates) for errors.
• The next version-update PRs arrive only for releases older than their cooldown; the excluded ones at once.

---

Generated with magex dependabot:harden