# Dependabot Config

> Operational skill for Dependabot: dependabot.yml ecosystems, schedules, grouping, ignore rules, and safe auto-merge policies.

- Skill: `alivirgo/dependabot-config` (Agent Skill)
- Install (CLI): `npx skillmds@latest add alivirgo/dependabot-config`
- Raw SKILL.md: https://api.skillmd.com/api/skills/alivirgo/dependabot-config/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: alivirgo (https://skillmd.com/u/alivirgo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/alivirgo/dependabot-config

---


# Dependabot Configuration AI Skill Guide

## Overview & Engine Architecture

Dependabot opens pull requests that bump dependency versions and alert on known vulnerabilities. Configuration lives in `.github/dependabot.yml` per ecosystem (npm, pip, docker, github-actions, terraform, etc.). Agents tune schedules, group related updates, ignore noisy packages deliberately, and require CI green before merge.

```
.github/dependabot.yml
   -> GitHub Dependabot service
       -> Version update PRs + security updates
           -> CI checks -> human/auto merge
```

## When to use this skill

- Enabling or retuning dependency update bots
- Reducing PR floods with groups and schedules
- Ignoring packages that must stay pinned
- Aligning security updates with SCA tools like `@snyk`

## Operational directives

1. Commit a valid `dependabot.yml` under `.github/`.
2. Prefer weekly schedules for apps; daily only if you can review volume.
3. Group minor/patch updates where supported to cut PR noise.
4. Never ignore all updates globally; ignore specific deps with reasons in comments/docs.
5. Auto-merge only patch/minor with required status checks - never blind major auto-merge.

## Config sketch

```yaml
version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
      day: monday
    open-pull-requests-limit: 10
    groups:
      production-patch:
        dependency-type: production
        update-types: ["minor", "patch"]
    ignore:
      - dependency-name: "legacy-sdk"
        versions: [">=3.0.0"]

  - package-ecosystem: github-actions
    directory: "/"
    schedule:
      interval: weekly

  - package-ecosystem: docker
    directory: "/"
    schedule:
      interval: weekly
```

## Tuning matrix

| Problem | Adjustment |
| --- | --- |
| Too many PRs | Groups + lower limit + weekly interval |
| Majors break CI constantly | Manual majors; group only minor/patch |
| Private registry fails | Configure registry credentials in Dependabot secrets |
| Lockfile conflicts | Smaller groups; rebase settings; keep CI fast |

## Best practices

- Review security updates faster than routine version bumps.
- Keep Actions pinned to SHAs if that is org policy; Dependabot can still propose bumps.
- Document ignored dependencies in the repo security doc with owners.
- Pair with `@snyk` or GitHub Advisories - Dependabot is not the only signal.

## Limitations

- Ecosystem support and grouping features evolve - verify against current GitHub docs.
- Monorepos may need multiple `directory` entries.
- Some private/monolithic packages do not update cleanly without custom registries.

## Related skills

- `@snyk` - complementary SCA scanning and fix advice
- `@github-packages-npm` - private package consumption that Dependabot must authenticate to
- `@codeql` - code vulnerability scanning beside dependency bumps