fix: drop unsupported semver cooldown keys from github-actions entry

[cuioss-oliver]

Dependabot version updates have been disabled in this repo since 2026-02-19

.github/dependabot.yml is invalid. Dependabot's check-run on 7fa52b37 — the last commit to touch the file — reports failure:

The property '#/updates/1/cooldown/semver-major-days' is not supported for the package ecosystem 'github-actions'.
(same for semver-minor-days and semver-patch-days)

A single rejected property invalidates the entire file, so version updates have been off for every ecosystem here — maven included, not just the github-actions entry.

It stayed invisible for two reasons: Dependabot reports config errors in a check-run, not an Actions run (so gh run list and a green build never show it), and that check only re-runs when dependabot.yml itself changes — so every commit since has been silent about it.

The fix

Removed the three semver-*-days keys from the github-actions entry, keeping default-days: 3. The maven entry supports them and keeps its tiering. A short comment records why the keys must not come back.

Verification

• Parses locally; github-actions → {default-days: 3}, maven → tiered block unchanged.
• The authoritative confirmation is the .github/dependabot.yml check-run on the merge commit, which is where Dependabot re-validates. Will verify there after merge.

Context

Found by an org-wide sweep of all 24 cuioss repos carrying a dependabot.yml; 5 were broken the same way. Root cause was the org-level /update-github-actions command instructing the tiered block on every ecosystem entry — fixed in cuioss/cuioss-organization#233, with the "repair an existing wrong block" case in cuioss/cuioss-organization#234.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CucanbUKECmSi3Bn6TFxxw

Summary by CodeRabbit

• Chores
  • Updated automated dependency update settings to use the supported cooldown configuration.
  • Removed unsupported version-specific cooldown options.

[sourcery-ai]

Sorry @cuioss-oliver, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: cuioss/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d0afc421-dda8-4306-a028-3387ad48e33f

📥 Commits

Reviewing files that changed from the base of the PR and between 4aaf550 and 5d7ff04.

📒 Files selected for processing (1)

• .github/dependabot.yml

---

📝 Walkthrough

Walkthrough

The Dependabot GitHub Actions configuration now retains only default-days: 3 and documents the removed unsupported semver-specific cooldown keys.

Changes

Dependabot configuration

Layer / File(s)	Summary
Cooldown setting cleanup .github/dependabot.yml	The configuration removes unsupported semver-specific cooldown keys and retains default-days: 3. It documents the unsupported keys.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the removal of unsupported semver cooldown keys from the GitHub Actions Dependabot configuration.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}