fix: dependabot: allow 'day' field for non-weekly intervals (#1308)

crates/github-actions-models/src/dependabot/v2.rs

@@ -442,11 +442,10 @@ impl<'de> Deserialize<'de> for Schedule {
             ));
         }
 
-        if schedule.interval != Interval::Weekly && schedule.day.is_some() {
-            return Err(custom_error::<D>(
-                "`schedule.day` is only valid when `schedule.interval` is `weekly`",
-            ));
-        }
+        // NOTE(ww): `day` only makes sense with `interval: weekly`, but
+        // Dependabot appears to silently ignore it otherwise. Consequently,
+        // we don't check that for now.
+        // See https://github.com/zizmorcore/zizmor/issues/1305.
 
         Ok(schedule)
     }

crates/github-actions-models/tests/sample-dependabot/v2/day-on-daily.invalid.yml

@@ -1,7 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: "/"
-    schedule:
-      interval: daily
-      day: monday

crates/github-actions-models/tests/sample-dependabot/v2/issue-1305.yml

@@ -0,0 +1,13 @@
+# https://github.com/zizmorcore/zizmor/issues/1305
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+      day: sunday
+    commit-message:
+      prefix: ci
+    labels:
+      - dependencies

crates/github-actions-models/tests/test_dependabot_v2.rs

@@ -115,15 +115,6 @@ fn test_schedule_cronjob_rejected_for_non_cron() {
     );
 }
 
-#[test]
-fn test_schedule_day_only_for_weekly() {
-    let err = load_dependabot_result("day-on-daily.invalid.yml").unwrap_err();
-    assert!(
-        err.to_string()
-            .contains("`schedule.day` is only valid when `schedule.interval` is `weekly`")
-    );
-}
-
 #[test]
 fn test_schedule_weekly_accepts_day() {
     let dependabot = load_dependabot("weekly-with-day.yml");