tune-dependabot-config

What this skill does

# Tune Dependabot Config

## Overview

**Two changes applied to every `updates:` entry in `.github/dependabot.yml`:**

1. **Group minor and patch updates.** Add a catch-all group that batches minor and patch bumps for the ecosystem into a single rolling PR. Major updates stay as individual PRs.
2. **Add a 7-day cooldown.** Wait 7 days after a release before opening a PR so broken releases get yanked or patched first.

**Core principle:** Reduce dependabot PR noise on safe updates while preserving one-PR-per-package signal on breaking changes. Majors get individual PRs because each one is a breaking change that needs to be evaluated on its own — batching them hides which package failed CI.

## Dispatch this skill to a subagent

When this skill is invoked, dispatch the work to a `general-purpose` subagent via the `Agent` tool. **Do not run the transforms inline in the caller's context.**

Why:
- The skill reads `.github/dependabot.yml`, walks every `updates:` entry, computes minimal edits per entry, writes the file, and runs a YAML parser sanity check. With several ecosystems in play, that is a meaningful amount of `Read`/`Edit`/`Bash` tool traffic the caller doesn't need to see.
- The caller only needs the final summary line (groups added, cooldown added, existing groups preserved). Everything else is intermediate state.

How to dispatch:
- Brief the subagent with this SKILL.md as its working spec — pass the path or invoke the skill from inside the subagent.
- Tell the subagent the working directory.
- Require the subagent to report back, in under 200 words: the summary line and any entries skipped (paused, security-only, user-tuned cooldown) with reason.
- If the YAML sanity check fails after editing, the subagent must stop and surface the failure rather than continuing or auto-reverting.

If the user explicitly asks to run inline (e.g. "do it here so I can watch"), honour that — the subagent dispatch is the default, not a hard requirement.

## When to Use

- User asks to set up, tune, harden, clean up, or audit dependabot config
- A repo has `.github/dependabot.yml` with no `groups:` or no `cooldown:` block
- A repo has many open dependabot PRs cluttering the PR queue
- Adding dependabot to a repo for the first time

**Skip when:**
- The user has explicitly customised groups for a reason (e.g. `aws-sdk-*` separated from rest); preserve their groups, only add what's missing
- The entry has `open-pull-requests-limit: 0` (paused) — leave it alone
- An entry is security-updates only — cooldown does not apply to security updates

## The Two Transforms

### 1. Catch-all minor + patch group

Inside each `updates:` entry, ensure a group exists that matches every dependency for minor and patch updates only:

```yaml
groups:
  minor-and-patch:
    patterns:
      - '*'
    update-types:
      - 'minor'
      - 'patch'
```

**Why explicit `update-types`:** Without it, group behaviour depends on dependabot defaults that have shifted over time and differ between version-updates and security-updates. Listing the two update types unambiguously batches minor + patch and leaves majors as individual PRs.

**Why exclude major:** A grouped major-bump PR hides which package broke when CI fails, and reverting one package out of a batch is awkward. Individual PRs for majors keep the signal clean.

**Exception — `github-actions`:** Use **two groups** for the GitHub Actions ecosystem — one for major bumps, one for minor + patch:

```yaml
groups:
  major-updates:
    patterns:
      - '*'
    update-types:
      - 'major'
  minor-and-patch:
    patterns:
      - '*'
    update-types:
      - 'minor'
      - 'patch'
```

**Why two groups:** Related actions (`actions/upload-artifact` and `actions/download-artifact`, `actions/cache/save` and `actions/cache/restore`) ship coordinated major bumps where the artifact or cache format changes — merging one without the other breaks CI. Batching majors together keeps the coordinated pair atomic. Keeping major in its own group (rather than mixing all three) means a routine minor/patch PR can land without waiting for the major-bump PR to clear review, and a failing major-bump PR doesn't block patch updates.

**If the user already has groups:** Preserve them. Only add the catch-all if no existing group has `patterns: ['*']` covering the required update types (minor + patch for most ecosystems; major + minor + patch for `github-actions`). A more-specific group always wins for matched dependencies, so adding a catch-all alongside is safe — it sweeps up everything the named groups don't claim. If the user has an existing catch-all that already includes `major` in its update-types, leave it — they made that choice deliberately.

### 2. Cooldown

Inside each `updates:` entry where `applies-to` is `version-updates` (the default), add:

```yaml
cooldown:
  default-days: 7
```

`default-days: 7` is enough for every ecosystem — both the SemVer-aware ones (npm, Bundler, Cargo, Composer, Gomod, Gradle, Maven, NuGet, Pip, UV, etc.) and the ecosystems that only honour `default-days` (Docker, GitHub Actions, Helm, Terraform, Devcontainers, Bazel, Conda, Hex/Mix, Gitsubmodule, Docker Compose).

**Do not add cooldown to security-update entries** — dependabot ignores it there, and the whole point of security updates is to land fast.

## Schema Reference

### `groups:` (per ecosystem entry)

| Key | Purpose |
|---|---|
| `IDENTIFIER` | Group name (letters, hyphens, underscores; must start and end with a letter) |
| `applies-to` | `version-updates` (default) or `security-updates` |
| `dependency-type` | `production` or `development` |
| `patterns` | List of name globs to include (e.g. `["*"]`, `["aws-sdk-*"]`) |
| `exclude-patterns` | Globs to exclude |
| `update-types` | Subset of `["major", "minor", "patch"]` |

### `cooldown:` (per ecosystem entry, version-updates only)

| Key | Purpose |
|---|---|
| `default-days` | Cooldown for any update without a more-specific rule |
| `semver-major-days` | Major version cooldown (SemVer ecosystems only) |
| `semver-minor-days` | Minor version cooldown (SemVer ecosystems only) |
| `semver-patch-days` | Patch version cooldown (SemVer ecosystems only) |
| `include` | Glob list to scope cooldown to (≤150 entries) |
| `exclude` | Glob list to exclude (≤150 entries) |

This skill writes only `default-days: 7`. If the user later wants tighter patch / longer major windows, they can split it themselves.

## Algorithm

For each `- ` entry under `updates:` in `.github/dependabot.yml`:

1. **Skip if paused.** If the entry has `open-pull-requests-limit: 0`, leave it alone.
2. **Determine update class.** If `applies-to: security-updates`, only step 3 applies.
3. **Ensure grouping.** The required catch-all groups depend on `package-ecosystem`:
   - For `github-actions`: two catch-alls — `major-updates` with `update-types: [major]`, and `minor-and-patch` with `update-types: [minor, patch]`.
   - For every other ecosystem: one catch-all — `minor-and-patch` with `update-types: [minor, patch]`.

   Then, for each required catch-all:
   - If no group with `patterns: ['*']` covers the required `update-types`, add the catch-all alongside the existing groups.
   - Otherwise leave that catch-all out — it's already satisfied.

   Existing user-defined groups are always preserved.
4. **Ensure cooldown** (skip for security-updates entries).
   - If no `cooldown:` key exists, add `cooldown: { default-days: 7 }`.
   - If `cooldown:` exists with no `default-days`, add `default-days: 7`.
   - Otherwise leave cooldown alone — the user has tuned it deliberately.
5. **Preserve everything else** — comments, key order, `schedule`, `directory`, `ignore`, `assignees`, `labels`, etc.
6. **Match the file's quoting style.** Scan the existing file for quote usage on string values:
   - If the file uses double quotes consistently, write new strings with double quotes.
   - If the file uses single quotes consistently, write new strings with single quotes.