require-dependabot-schedule-timezone
Rule catalog ID: R076
Targeted pattern scopeโ
Dependabot schedule mappings that use time or cron semantics, including values inherited from multi-ecosystem-groups.
What this rule reportsโ
This rule reports schedule blocks that require timezone context but omit schedule.timezone.
Why this rule existsโ
Without a timezone, explicit times default to UTC. Requiring timezone makes scheduled runs match local operational intent instead of silently shifting around daylight saving or team-region assumptions.
โ Incorrectโ
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
time: "05:30"
โ Correctโ
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
time: "05:30"
timezone: "America/Detroit"
Additional examplesโ
When teams operate outside UTC, this rule prevents silent schedule drift caused by assuming everyone reads time values in the same timezone.
ESLint flat config exampleโ
import githubActions from "eslint-plugin-github-actions-2";
export default [githubActions.configs.dependabot];
When not to use itโ
Disable this rule if the repository intentionally standardizes all Dependabot schedules on implicit UTC.