From cd2006225571edcadccbb9a88f1124db431688b0 Mon Sep 17 00:00:00 2001
From: Taiki Endo <te316e89@gmail.com>
Date: Sun, 29 Mar 2026 00:12:26 +0900
Subject: [PATCH] ci: Update config

---
 .github/.cspell/project-dictionary.txt | 1 +
 .github/dependabot.yml                 | 4 +++-
 .github/workflows/release.yml          | 2 ++
 .github/zizmor.yml                     | 2 --
 4 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/.cspell/project-dictionary.txt b/.github/.cspell/project-dictionary.txt
index e0bad593..ef713a19 100644
--- a/.github/.cspell/project-dictionary.txt
+++ b/.github/.cspell/project-dictionary.txt
@@ -27,6 +27,7 @@ pluginconf
 ppcle
 prek
 quickinstall
+rclone
 rdme
 rootfs
 sccache
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 10ea2a69..8ef40272 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: cargo
+  - package-ecosystem: cargo # zizmor: ignore[dependabot-cooldown] # Unless dependencies are pinned/locked, the effect is limited.
     directory: /
     schedule:
       interval: daily
@@ -14,6 +14,8 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: ''
     labels: []
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 63c93770..cf958670 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -258,6 +258,8 @@ jobs:
           release_date="${RELEASE_DATE}"
 
           # Make sure the current revision is same as prepare step.
+          # --unshallow is necessary to successfully push the
+          # "releases/${major_version_tag}" branch in the subsequent step.
           retry git fetch origin --unshallow &>/dev/null
           rev=$(git rev-parse HEAD)
           if [[ "${rev}" != "${PREPARE_REV}" ]]; then
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 76b9bac6..b5be7c9c 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -2,10 +2,8 @@
 # https://docs.zizmor.sh/configuration/
 
 rules:
-  dependabot-cooldown: { disable: true } # Unless dependencies are pinned/locked, the effect is limited.
   secrets-inherit: { disable: true }
   unpinned-uses:
     config:
       policies:
         taiki-e/*: any
-        '*': ref-pin