Skip to content

Cooldown - exclude not working for github-actions ecosystem #16502

Open
Open
Cooldown - exclude not working for github-actions ecosystem#16502
Assignees
v-robaiken
Labels
L: github:actionsGitHub ActionsT: bug 🐞Something isn't working

Description

@jrfnl
jrfnl
opened on Oct 8, 2026

Is there an existing issue for this?

  • I have searched the existing issues

Package ecosystem

github-actions

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

PHPCSStandards/PHPCSDevTools@4300e00

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "cron"
      cronjob: "10 22 5,20 * *" # At 22:10, every 5th and 20th day of the month.
    open-pull-requests-limit: 5
    target-branch: "stable"
    groups:
      action-runners:
        applies-to: version-updates
        update-types:
          - "minor"
          - "patch"
    cooldown:
      default-days: 10
      exclude:
        - "phpcsstandards/xmllint-validate"
        - "PHPCSStandards/.github/.github/workflows/"

Updated dependency

Well, actually, the expected update didn't happen and that's the problem.

Dependency: https://github.com/PHPCSStandards/.github

Expected update from Release v1.2.2 to v1.3.0 (released October 4th, Dependabot in user repo ran on October 5th), but no PR was opened to include this update.

https://github.com/PHPCSStandards/.github/releases

What you expected to see, versus what you actually saw

Ì expected Dependabot to update the GHA workflow files to the latest version of an excluded package, which had a release the day before Dependabot ran, but instead Dependabot used the default-days cooldown period and ignored the new release.

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

Attempt 1

With this as a minimal config:

  - package-ecosystem: "github-actions"
    target-branch: "stable"
    cooldown:
      default-days: 10
      exclude:
        - "PHPCSStandards/.github/.github/workflows/"

...and the PHPCSStandards/.github package having had a release within the last 10 days, the logs show:

updater | 2026/10/05 22:13:19 INFO <job_1611468536> Available release version/ref is 1.3.0
...
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 1 (cooldown days 10)

... while the package is excluded from cooldown and should update.

Log details 
updater | 2026/10/05 22:13:18 INFO <job_1611468536> Checking if PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml 1.2.2 needs updating
  proxy | 2026/10/05 22:13:19 [762] GET [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack)
  proxy | 2026/10/05 22:13:19 [762] 200 [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack) (cached)
  proxy | 2026/10/05 22:13:19 [764] GET [https://api.github.com:443/repos/PHPCSStandards/.github/releases?per_page=100](https://api.github.com/repos/PHPCSStandards/.github/releases?per_page=100)
  proxy | 2026/10/05 22:13:19 [764] 200 [https://api.github.com:443/repos/PHPCSStandards/.github/releases?per_page=100](https://api.github.com/repos/PHPCSStandards/.github/releases?per_page=100) (cached)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Available release version/ref is 1.3.0
2026/10/05 22:13:19 INFO <job_1611468536> Initializing cooldown filter
  proxy | 2026/10/05 22:13:19 [766] GET [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack)
2026/10/05 22:13:19 [766] 200 [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack) (cached)
  proxy | 2026/10/05 22:13:19 [767] POST [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack)
  proxy | 2026/10/05 22:13:19 [767] 200 [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack) (cached)
  proxy | 2026/10/05 22:13:19 [768] POST [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack)
  proxy | 2026/10/05 22:13:19 [768] 200 [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack) (cached)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 1 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 77 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 92 (cooldown days 10)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 107 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 184 (cooldown days 10)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 198 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 214 (cooldown days 10)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 285 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 287 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 287 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Found acceptable version outside cooldown: 1.2.2
2026/10/05 22:13:19 INFO <job_1611468536> Latest version is 1.2.2
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Available release version/ref is 1.3.0
2026/10/05 22:13:19 INFO <job_1611468536> Initializing cooldown filter
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 1 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 77 (cooldown days 10)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 92 (cooldown days 10)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 107 (cooldown days 10)
updater | 2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 184 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 198 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 214 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 285 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 287 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Days since release : 287 (cooldown days 10)
2026/10/05 22:13:19 INFO <job_1611468536> Found acceptable version outside cooldown: 1.2.2
updater | 2026/10/05 22:13:19 INFO <job_1611468536> No update needed for PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml 1.2.2

Attempt 2

With this as a minimal config:

  - package-ecosystem: "github-actions"
    target-branch: "stable"
    cooldown:
      default-days: 10
      exclude:
        - "PHPCSStandards/.github"

...and the PHPCSStandards/.github package having had a release within the last 10 days, the logs show:

updater | 2026/10/05 22:51:33 INFO <job_1611535581> Available release version/ref is 1.3.0
...
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 1 (cooldown days 10)

... while the package is excluded from cooldown and should update.

Log details 
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Checking if PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml 1.2.2 needs updating
  proxy | 2026/10/05 22:51:33 [738] GET [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack)
2026/10/05 22:51:33 [738] 200 [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack) (cached)
  proxy | 2026/10/05 22:51:33 [740] GET [https://api.github.com:443/repos/PHPCSStandards/.github/releases?per_page=100](https://api.github.com/repos/PHPCSStandards/.github/releases?per_page=100)
  proxy | 2026/10/05 22:51:33 [740] 200 [https://api.github.com:443/repos/PHPCSStandards/.github/releases?per_page=100](https://api.github.com/repos/PHPCSStandards/.github/releases?per_page=100) (cached)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Available release version/ref is 1.3.0
2026/10/05 22:51:33 INFO <job_1611535581> Initializing cooldown filter
  proxy | 2026/10/05 22:51:33 [742] GET [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack)
2026/10/05 22:51:33 [742] 200 [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack) (cached)
  proxy | 2026/10/05 22:51:33 [743] POST [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack)
  proxy | 2026/10/05 22:51:33 [743] 200 [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack) (cached)
  proxy | 2026/10/05 22:51:33 [744] POST [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack)
2026/10/05 22:51:33 [744] 200 [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack) (cached)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 1 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 77 (cooldown days 10)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 92 (cooldown days 10)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 107 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 184 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 198 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 214 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 285 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 287 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 287 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Found acceptable version outside cooldown: 1.2.2
2026/10/05 22:51:33 INFO <job_1611535581> Latest version is 1.2.2
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Available release version/ref is 1.3.0
2026/10/05 22:51:33 INFO <job_1611535581> Initializing cooldown filter
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 1 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 77 (cooldown days 10)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 92 (cooldown days 10)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 107 (cooldown days 10)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 184 (cooldown days 10)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 198 (cooldown days 10)
updater | 2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 214 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 285 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 287 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Days since release : 287 (cooldown days 10)
2026/10/05 22:51:33 INFO <job_1611535581> Found acceptable version outside cooldown: 1.2.2
updater | 2026/10/05 22:51:33 INFO <job_1611535581> No update needed for PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml 1.2.2

Attempt 3

With this as a minimal config:

  - package-ecosystem: "github-actions"
    target-branch: "stable"
    cooldown:
      default-days: 10
      exclude:
        - "PHPCSStandards/*"

...and the PHPCSStandards/.github package having had a release within the last 10 days, the logs show:

updater | 2026/10/05 23:17:02 INFO <job_1611585018> Available release version/ref is 1.3.0
...
updater | 2026/10/05 23:17:02 INFO <job_1611585018> Days since release : 1 (cooldown days 10)

... while the package is excluded from cooldown and should update.

Log details 
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Checking if PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml 1.2.2 needs updating
  proxy | 2026/10/05 23:16:59 [666] GET [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack)
2026/10/05 23:16:59 [666] 200 [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack) (cached)
  proxy | 2026/10/05 23:16:59 [668] GET [https://api.github.com:443/repos/PHPCSStandards/.github/releases?per_page=100](https://api.github.com/repos/PHPCSStandards/.github/releases?per_page=100)
2026/10/05 23:16:59 [668] 200 [https://api.github.com:443/repos/PHPCSStandards/.github/releases?per_page=100](https://api.github.com/repos/PHPCSStandards/.github/releases?per_page=100) (cached)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Available release version/ref is 1.3.0
2026/10/05 23:16:59 INFO <job_1611585018> Initializing cooldown filter
  proxy | 2026/10/05 23:16:59 [670] GET [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack)
  proxy | 2026/10/05 23:16:59 [670] 200 [https://github.com:443/phpcsstandards/.github.git/info/refs?service=git-upload-pack](https://github.com/phpcsstandards/.github.git/info/refs?service=git-upload-pack) (cached)
  proxy | 2026/10/05 23:16:59 [671] POST [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack)
  proxy | 2026/10/05 23:16:59 [671] 200 [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack) (cached)
  proxy | 2026/10/05 23:16:59 [672] POST [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack)
2026/10/05 23:16:59 [672] 200 [https://github.com:443/phpcsstandards/.github.git/git-upload-pack](https://github.com/phpcsstandards/.github.git/git-upload-pack) (cached)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 1 (cooldown days 10)
2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 77 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 92 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 107 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 184 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 198 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 214 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 285 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 287 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 287 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Found acceptable version outside cooldown: 1.2.2
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Latest version is 1.2.2
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Available release version/ref is 1.3.0
2026/10/05 23:16:59 INFO <job_1611585018> Initializing cooldown filter
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 1 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 77 (cooldown days 10)
2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 92 (cooldown days 10)
2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 107 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 184 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 198 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 214 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 285 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 287 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Days since release : 287 (cooldown days 10)
updater | 2026/10/05 23:16:59 INFO <job_1611585018> Found acceptable version outside cooldown: 1.2.2
updater | 2026/10/05 23:16:59 INFO <job_1611585018> No update needed for PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml 1.2.2

Smallest manifest that reproduces the issue

Difficult to create a reproducer as you need a release within the ten day timeframe.

For the next few days (until October 13), this should still be able to reproduce it:

.github/dependabot.yml

version: 2
updates:
  - package-ecosystem: "github-actions"
    target-branch: "stable"
    cooldown:
      default-days: 10
      exclude:
        - "PHPCSStandards/*" # ...or use any of the other examples which didn't work as shown above.

.github/workflows/mdl.yml

name: CS

on:
  push:
  pull_request:

jobs:
  markdownlint:
    name: 'Lint Markdown'
    uses: PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml@c535983699986d1c538d4e47f33e813fcfbcc8a0 # v1.2.2

As things are, this will result in no update PR being created, while the expectation is that an update PR would be opened by Dependabot as the package which needs an update has a new release and is excluded from the cooldown period.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

L: github:actionsGitHub ActionsT: bug 🐞Something isn't working

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions