Add a .github/dependabot.yml to every active repo in the Patina-Network GitHub org. Each file must list every package ecosystem in that repo, so dependency and GitHub Actions updates arrive as weekly PRs.
Use the config written for hello-world-grpc-client-go as the template. It is not pushed yet because the remote repo is still empty.
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule: { interval: weekly }
- package-ecosystem: bun
directory: /.github/scripts
schedule: { interval: weekly }
- package-ecosystem: docker
directory: /
schedule: { interval: weekly }
- package-ecosystem: npm
directory: /frontend
schedule: { interval: weekly }
- package-ecosystem: gomod
directory: /
schedule: { interval: weekly }
None of the 12 active repos has a .github/dependabot.yml on its default branch yet. Manifests found in each repo's default-branch tree:
| Repo | Ecosystem → directories |
|---|---|
| codebloom | github-actions /; bun /.github/scripts; npm (pnpm) /e2e, /email, /js; maven /; cargo /internal/standup-bot; docker /infra, /internal/standup-bot |
| patchats | github-actions /; bun /.github/scripts; npm (pnpm) /js; maven /; docker /infra |
| platform-infra | github-actions /; bun /, /.github/scripts |
| k8s-manifests | github-actions /; bun /.github/scripts. If manifests pin image tags, check whether Dependabot's docker/helm ecosystems can track them (not verified). |
| docs | github-actions /; bun /.github/scripts; pip / (requirements.txt); docker / |
| hello-world-grpc-service | github-actions /; bun /.github/scripts; cargo /; docker / |
| dockerfiles | github-actions /; bun /.github/scripts; docker /src/gerrit, /src/pg-az (or glob /src/*) |
| hello-world-grpc-client-go | The remote repo is empty. Push the reference config above along with the initial code. |
| hello-world-grpc-client-java, hello-world-grpc-client-rust | Empty repos. Add a config once code lands (maven/gradle or cargo, plus github-actions, bun and docker if present). |
| hello-world-clients | Tree API returned 404 on main. Inspect manually. |
| .github | Only profile/README.md. Nothing to configure. |
Re-check the inventory before starting; repos may have changed.
package-ecosystem: npm. The lockfile must be in the configured directory.bun only supports the text bun.lock format, not the binary bun.lockb.github-actions with directory: / scans .github/workflows. Composite actions in other locations need their own directories.directories: (plural, supports globs) instead of duplicate blocks.dependabot.yml from the org .github repo. Every repo needs its own file.if: conditions that skip jobs for Dependabot. The jobs that need secrets will fail on Dependabot's own runs. That is expected, and it forces a person to look at the PR before its code gets secrets.
platform-infra ci.yaml → preview (Azure); codebloom ci-cd.yml → validateDBSchema (Headscale); hello-world-grpc-service ci.yaml → buildUploadClientsImageStaging, buildUploadServerImageStaging (Headscale).gh pr close N && gh pr reopen N). The reopen run is started by that person, so it gets the normal Actions secrets. Do this right before merging, because every Dependabot rebase or update starts a new Dependabot run that fails again.dependabot[bot]) and its restrictions.gh or the UI, not @dependabot close / @dependabot reopen comments, which are deprecated.groups to batch minor and patch updates and cut down PR noise. If you do, use the same grouping in every repo..github/dependabot.yml merged to its default branch, and the file covers every ecosystem and directory in the table above.