Skip to content

docs: add Dependabot configuration documentation #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zircote merged 1 commit into from
Mar 2, 2026
Merged

docs: add Dependabot configuration documentation #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions docs/automation-overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,15 @@ Automatically merged after CI passed.
- CI checks fail
- Conflicts with other changes

**Configuration:**

Dependabot is configured in `.github/dependabot.yml` to:
- Check for GitHub Actions updates weekly (Mondays at 9 AM Central)
- Group minor and patch updates together
- Apply `dependencies` and `github-actions` labels automatically

Comment on lines +226 to +230
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section says Dependabot applies both dependencies and github-actions labels, but later in the same doc the “Workflow Labels” table only documents the dependencies label. Consider documenting github-actions there as well (or adjusting this bullet) so the labeling story stays consistent for readers.

Copilot uses AI. Check for mistakes.
See [Workflow Reference - Dependabot Configuration](./workflow-reference.md#dependabot-configuration) for details on customizing the configuration.

---

## Workflow Labels
Expand Down
89 changes: 89 additions & 0 deletions docs/workflow-reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,95 @@ uses: zircote/.github/.github/workflows/reusable-dependabot-automerge.yml@main

---

### Dependabot Configuration

**File:** `.github/dependabot.yml`

Configures how Dependabot monitors and updates dependencies.

**Current Configuration:**

````yaml
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
timezone: "America/Chicago"
open-pull-requests-limit: 5
commit-message:
prefix: "chore(deps)"
labels:
- "dependencies"
- "github-actions"
reviewers:
- "zircote"
groups:
github-actions:
patterns:
- "*"
update-types:
- "minor"
- "patch"
````

**What it monitors:**

- **GitHub Actions** - Workflow action versions in `.github/workflows/`

**Schedule:**
- Checks for updates every Monday at 9:00 AM Central Time
- Creates up to 5 PRs at a time to avoid overwhelming the queue

**Automatic behaviors:**
- Groups minor and patch updates into a single PR when possible
- Applies `dependencies` and `github-actions` labels
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The docs say Dependabot “applies dependencies and github-actions labels”, but this repo’s .github/labels.yml doesn’t define either label. If label sync is used, these labels won’t exist and Dependabot won’t be able to apply them. Consider either adding these labels to .github/labels.yml or adding a note here that the labels must exist in the repo before Dependabot can apply them.

Suggested change
- Applies `dependencies` and `github-actions` labels
- Applies `dependencies` and `github-actions` labels if they exist in the repository (ensure they are defined in `.github/labels.yml` when using label sync)

Copilot uses AI. Check for mistakes.
- Requests review from @zircote
- Uses conventional commit format: `chore(deps): ...`

**Customization:**

To add more package ecosystems (e.g., npm, pip, docker):

````yaml
updates:
# Existing github-actions configuration...

- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 5
labels:
- "dependencies"
- "npm"
````

**Supported ecosystems:**
- `github-actions` - GitHub Actions workflows
- `npm` - JavaScript/Node.js
- `pip` - Python
- `docker` - Docker images
- `composer` - PHP
- `maven` - Java/Maven
- `gradle` - Java/Gradle
- `bundler` - Ruby
- `cargo` - Rust
- `gomod` - Go modules
Comment on lines +169 to +179
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This “Supported ecosystems” list looks like it’s intended to be comprehensive, but it omits several Dependabot ecosystems (e.g., nuget, terraform, gitsubmodule, etc.). To avoid stale/inaccurate docs, either clarify that this is a non-exhaustive list of common ecosystems or replace it with a link/summary that points readers to the official GitHub list for the complete set.

Copilot uses AI. Check for mistakes.

**Common schedule options:**
- `daily` - Every day
- `weekly` - Once per week (specify day)
- `monthly` - Once per month

**Documentation:**
- [Dependabot configuration reference](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file)

---

## Agentic Workflows

Agentic workflows use AI to understand context and make intelligent decisions. They are defined in Markdown files and compiled to `.lock.yml` files.
Expand Down