# Gen Dependency Updater

> Generate a Dependabot or Renovate config (`.github/dependabot.yml` or `renovate.json`) for the active stack with sensible defaults (weekly schedule, minor+patch grouping, open-PR cap at 5). Preview- before-mutate: prints the rendered config and exits without writing unless `--apply` is passed. Idempotent: same content is a no-op, different content shows a diff and refuses to overwrite without `--force-overwrite`. TRIGGER when the user says "add dependabot", "enable dependabot", "add renovate", "set up renovate", "configure dependency updates", "automate dependency updates", "scaffold dependabot.yml", "create renovate.json", "add automated dependency PRs", "wire dependency bot", "turn on dependency updates", "/nyann:gen-dependency-updater". Do NOT trigger on "update my dependencies" / "run npm update" — that's a one-off package-manager invocation, not config scaffolding. Do NOT trigger on "fix this dependabot PR" — that's a workflow inside a specific PR, not config generation.

- Skill: `thettwe/gen-dependency-updater` (Agent Skill)
- Install (CLI): `npx skillmds@latest add thettwe/gen-dependency-updater`
- Raw SKILL.md: https://api.skillmd.com/api/skills/thettwe/gen-dependency-updater/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: thettwe (https://skillmd.com/u/thettwe)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/thettwe/gen-dependency-updater

---


# gen-dependency-updater

Wraps `bin/gen-dependency-updater.sh`. Emits a Dependabot or Renovate
config; preview-by-default; idempotent on apply.

## When to trigger

- User wants automated dependency PRs and doesn't already have either
  config wired up.
- User wants to migrate Dependabot ↔ Renovate.
- User wants to re-generate the config after upgrading nyann (the
  template defaults shift with each `snapshot_version`).

## When NOT to trigger

- User wants to **manually upgrade** a specific dep — that's
  `npm install`, `pip install -U`, `cargo update`, etc.
- User wants help **resolving** a Dependabot/Renovate PR — read the
  PR diff with them; this skill is for config generation only.
- User is in a non-GitHub forge — Dependabot is GitHub-specific.
  Renovate runs anywhere but its app installation is out of scope
  for this skill.

## Picking updater (when the user hasn't specified)

Default to **dependabot** when:
- The repo is on GitHub (which is nyann's `gh`-integration assumption).
- The user wants minimal moving parts (Dependabot is native to GH,
  no app to install).

Default to **renovate** when:
- The user mentions multi-platform forge support.
- The user wants advanced grouping / customization (Renovate's
  package rules are richer than Dependabot's `groups`).
- The user is already a Renovate user on other repos.

When in doubt, ask:
> "Dependabot is GitHub-native and zero-install — recommended for
> most. Renovate is more configurable but requires installing the
> Renovate GitHub App. Which do you want?"

## Picking ecosystems

Read the StackDescriptor (from `bin/detect-stack.sh`) and map:

| Stack hint | Ecosystem(s) |
|---|---|
| `primary_language=typescript` / `javascript` | `npm` |
| `primary_language=python` | `pip` |
| `primary_language=go` | `gomod` |
| `primary_language=rust` | `cargo` |
| `primary_language=ruby` | `bundler` |
| `primary_language=php` | `composer` |
| `primary_language=java` (Maven) | `maven` |
| `primary_language=java` (Gradle) / `kotlin` | `gradle` |
| `primary_language=dart` | `pub` |
| `primary_language=csharp` / `dotnet` | `nuget` |
| `primary_language=elixir` | `mix` (v1.10+) |
| `primary_language=swift` | `swift` |
| `Dockerfile` present | `docker` (in addition to language ecosystem) |
| `.github/workflows/` present | `github-actions` (always recommended) |

Always include `github-actions` even when the user didn't ask — it
keeps the SAST workflow pins current.

For monorepos (`workspaces` resolved by `bin/resolve-workspace-configs.sh`),
emit one `--ecosystem` per workspace with the workspace path as
`--directory`. Dependabot doesn't auto-walk; one entry per manifest
is mandatory.

## Preview, then apply

Always preview first. Even if the user said "just do it", show the
rendered config and wait for confirmation:

```
bin/gen-dependency-updater.sh --updater dependabot --ecosystem npm --ecosystem github-actions
```

Then on confirmation:

```
bin/gen-dependency-updater.sh --updater dependabot \
  --ecosystem npm --ecosystem github-actions \
  --target . --apply
```

If the destination file already exists and matches: log "unchanged"
and exit. If it differs: print diff, exit 3, prompt the user before
re-running with `--force-overwrite`.

## Output

- `.github/dependabot.yml` (Dependabot)
- `renovate.json` (Renovate, at repo root)

Both files include a comment header tagging the nyann version that
generated them, so a future operator can tell when to regenerate.

## Defaults explained

- **Schedule = weekly**: Daily is noisy for most teams; monthly lets
  CVEs sit. Weekly balances responsiveness vs. PR-fatigue.
- **Grouping = minor-patch**: Bundles minor + patch into one PR per
  ecosystem (review-friendly). Majors stay separate because they
  often need breaking-change review regardless of patch size.
- **open-prs = 5**: Enough headroom for routine churn; raise for
  high-velocity repos.
- **Labels = `dependencies`, `automated`**: `automated` lets you opt
  these out of expensive CI matrices via label filters.

Override any of these via the corresponding flags.