check-dependabot

Validating a Dependabot configuration

A dependabot.yml fails in two independent ways, and each needs its own check.

Syntactically, a misspelled key or an unsupported enum value makes GitHub reject the file. Dependabot reports this only under Insights → Dependency graph → Dependabot, so the usual symptom is silence: no PRs, no CI failure, nothing in the pull request list.

Semantically, the file is valid and Dependabot runs it happily, but it does not do what the author meant. A patterns entry naming a package the repo never installed groups nothing. An ignore entry for a package that was renamed or removed protects nothing. A package matched by two groups lands in whichever one Dependabot picks, not the one the comment above it claims. None of this surfaces until a PR arrives in the wrong shape, weeks later.

Schema validation catches the first class and is blind to the second. Run both.

Running scripts bundled with this skill

Script paths resolve relative to this SKILL.md, not the agent's CWD. If a relative command fails to resolve, prefix it with the directory the platform loaded SKILL.md from.

Fallback. If python3 cannot be located, analyze the script's purpose and logic and execute its intent with available tools, but warn the user that python is not available and the logic was executed with a fallback approach that may not be perfect.

Step 1 - Validate against the published schema

curl -fsSL https://www.schemastore.org/dependabot-2.0.json -o /tmp/dependabot-schema.json
python3 -c "import json,yaml,sys; json.dump(yaml.safe_load(open(sys.argv[1])),open(sys.argv[2],'w'))" \
  .github/dependabot.yml /tmp/dependabot-config.json
npx --yes ajv-cli@5 validate --spec=draft7 --strict=false --all-errors \
  -s /tmp/dependabot-schema.json -d /tmp/dependabot-config.json

Each flag is load-bearing:

• curl -fsSL - json.schemastore.org 301-redirects to www.schemastore.org. Without -L curl saves a ~170-byte HTML stub; -f is what turns that into a non-zero exit instead of a confusing downstream JSON parse error.
• --spec=draft7 - the schema declares draft-07. ajv-cli 5 ships ajv 8, whose default dialect is not draft-07.
• --strict=false - the schema carries the vendor keyword x-intellij-enum-metadata. ajv 8 strict mode rejects the schema over it and reports schema is invalid, which reads like a problem with the config.
• --all-errors - otherwise one error per run, turning a multi-error file into a slow loop.