dependabotlisted
Install: claude install-skill fmind/dot
# Dependabot
Keep GitHub Actions and dependencies current with one `.github/dependabot.yml`; [secure](../secure/SKILL.md) enables it during the security pass and [upgrade-tools](../upgrade-tools/SKILL.md) owns the bumps Dependabot cannot make (mise pins, formatter plugins).
## Workflow
1. **Map the ecosystems**: one `updates` entry per manifest directory, using the value Dependabot expects:
| Manifest | `package-ecosystem` |
| ---------------------------- | ------------------- |
| `.github/workflows/*.yml` | `github-actions` |
| `pyproject.toml` + `uv.lock` | `uv` |
| `Dockerfile` | `docker` |
| `*.tf` (Terraform) | `terraform` |
| `*.tf` (OpenTofu) | `opentofu` |
1. **Write the config**: weekly schedule, `chore(deps)` commit prefix, and one group per ecosystem for `minor` and `patch` updates so majors arrive alone:
```yaml
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
day: monday
commit-message:
prefix: "chore(deps)"
groups:
actions:
patterns: ["*"]
update-types: [minor, patch]
- package-ecosystem: uv
directory: /
schedule:
interval: weekly
day: monday
commit-message:
prefix: "chore(deps)"
groups:
python:
patterns: ["*