dependabot

Dependabot Dependency Management Standard

Canonical setup for GitHub Dependabot, an automated dependency update engine designed to keep dependencies and GitHub Actions pinned, secure, and current.

1. Principles

1. Pin-Everything Strategy: Pin GitHub Actions to a major-version tag (actions/checkout@v7) and Go, npm, and Python packages explicitly. Do not pin action SHAs — the tag already tracks security patches within the major, and SHAs turn every upstream patch into review noise.
2. Reduce PR Noise: Group minor, patch, and digest updates into single, consolidated pull requests using the Dependabot groups configuration (e.g., grouping GitHub Action updates or Go module updates) while leaving major updates separate.
3. Local Validation: Never merge automated updates blindly. Always run validation pipelines locally (mise run check and mise run test) before pushing/merging to verify compatibility and catch regressions.
4. No Auto-Merge: Do not configure auto-merge for dependencies. Automated systems cannot anticipate protocol, type-checking, or model drift.

2. Configuration Setup (.github/dependabot.yml)

Place a dependabot.yml at .github/dependabot.yml at the root of target repositories to manage updates, commit styling, and dependency groupings.

Example configuration for a repository with GitHub Actions and Go modules:

version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps)"
    groups:
      actions:
        patterns:
          - "*"
        update-types:
          - minor
          - patch
  - package-ecosystem: gomod
    directory: /dot
    schedule:
      interval: weekly
      day: monday
    commit-message:
      prefix: "chore(deps)"
    groups:
      go-modules:
        patterns:
          - "*"
        update-types:
          - minor
          - patch

3. Workflow & Commands

1. Verify Configuration: Dependabot validation is handled automatically by GitHub upon receiving pushes to .github/dependabot.yml. Any syntax errors will be reported in the repository's "Insights" -> "Dependency graph" -> "Dependabot" tab.
2. Trigger Manual Checks: To force Dependabot to check for updates immediately, go to your repository on GitHub, navigate to Insights -> Dependency graph -> Dependabot, click on the status/last-check details for a package ecosystem, and click Check for updates.
3. Local Verification: When a Dependabot PR is opened, fetch the branch locally and run static checkers and tests to verify correctness:

   git fetch origin
   git checkout check-dependabot-branch
   mise run check
   mise run test