dependabot

Dependabot

Keep GitHub Actions and dependencies current with one .github/dependabot.yml; secure enables it during the security pass and upgrade-tools owns the bumps Dependabot cannot make (mise pins, formatter plugins).

Workflow

1. Map the ecosystems: one updates entry per manifest directory, using the value Dependabot expects:

   Manifest	package-ecosystem
   .github/workflows/*.yml	github-actions
   go.mod	gomod
   pyproject.toml + uv.lock	uv
   package.json (npm, pnpm, yarn)	npm
   Dockerfile	docker
   *.tf (Terraform)	terraform
   *.tf (OpenTofu)	opentofu

2. Write the config: weekly schedule, chore(deps) commit prefix, and one group per ecosystem for minor and patch updates so majors arrive alone:

   version: 2
   updates:
     - package-ecosystem: github-actions
       directory: /
       schedule:
         interval: weekly
         day: monday
       commit-message:
         prefix: "chore(deps)"
       groups:
         actions:
           patterns: ["*"]
           update-types: [minor, patch]
     - package-ecosystem: gomod
       directory: /
       schedule:
         interval: weekly
         day: monday
       commit-message:
         prefix: "chore(deps)"
       groups:
         go-modules:
           patterns: ["*"]
           update-types: [minor, patch]
   

3. Validate: zizmor --offline --collect dependabot --strict-collection . checks the schema and audits the file offline (see zizmor); GitHub re-validates on push and shows errors in the Dependabot tab.

4. Review each PR locally: never merge blindly and never enable auto-merge.