Skip to main content

require-dependabot-schedule-time

Rule catalog ID: R075

Targeted pattern scopeโ€‹

Non-cron schedule mappings in Dependabot update entries, including schedule settings inherited from multi-ecosystem-groups.

What this rule reportsโ€‹

This rule reports update entries that use a non-cron interval without declaring schedule.time.

Why this rule existsโ€‹

GitHub assigns a random execution time when time is omitted. Requiring an explicit time makes Dependabot activity predictable and easier to coordinate with release windows and CI load.

โŒ Incorrectโ€‹

version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"

โœ… Correctโ€‹

version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
time: "05:30"
timezone: "UTC"

Additional examplesโ€‹

Repositories that want quieter daytime CI load often use this rule to keep Dependabot runs in an off-hours maintenance window.

ESLint flat config exampleโ€‹

import githubActions from "eslint-plugin-github-actions-2";

export default [githubActions.configs.dependabot];

When not to use itโ€‹

Disable this rule if random Dependabot run times are acceptable for the repository.

Further readingโ€‹