Configure and manage GitHub Dependabot dependency update workflows.
npx skills add https://github.com/lettucebo/Skills --skill dependabot-lettucebo
Please help me install this Agent Skill. Skill: dependabot Source: https://github.com/lettucebo/Skills/tree/main/skills/github/dependabot Command: npx skills add https://github.com/lettucebo/Skills --skill dependabot-lettucebo
.github/dependabot.yml files, which involves many ecosystem values, grouping rules, and scheduling options that are easy to misconfigure. ## Core Features & Use Cases - Ecosystem Detection and Configuration: Identify all package ecosystems in a repository (npm, pip, Docker, Terraform, and more) and generate correct dependabot.yml entries for each. - PR Noise Reduction: Apply dependency grouping, cross-directory monorepo grouping, multi-ecosystem groups, cooldown periods, and scheduling to batch updates into fewer pull requests. - Security Update Management: Configure grouped security updates, auto-triage rules, and pre-commit dependency vulnerability scanning via the GitHub MCP Server. - Use Case: A monorepo with npm workspaces, Docker images, and GitHub Actions can use this Skill to produce a single dependabot.yml that groups dev dependencies weekly, batches shared dependencies across directories, and limits security patches to grouped PRs. ## Quick Start Ask the agent to scan this repository and generate an optimized dependabot.yml with grouped updates for every detected ecosystem.High-intent search queries and answers about installing and using this skill.
Use the `directories` key with glob patterns like `/apps/*` and `/packages/*` to cover all workspace packages in one entry. Add `group-by: dependency-name` in a group to create a single PR when the same dependency updates across multiple directories.
Group related dependencies with the `groups` key using patterns, dependency-type, or update-types filters so they ship in one PR. You can also switch to monthly intervals, set cooldown periods, or use multi-ecosystem groups to batch updates further.
Yes. Use `package-ecosystem: "npm"` and Dependabot automatically detects `pnpm-lock.yaml` and `yarn.lock`. There is no separate pnpm or yarn ecosystem value.
No. GitHub supports exactly one file at `.github/dependabot.yml` on the default branch. Use multiple `updates` entries within that file to cover different ecosystems and directories.
Set `open-pull-requests-limit: 0` on the ecosystem entry, which disables version update PRs while security updates continue. You can also group security patches with `applies-to: security-updates` in a group.
GitHub deprecated the merge, close, and reopen PR comment commands in January 2026. Use GitHub's native auto-merge feature, the web UI, or `gh pr merge` from the CLI instead.
githubConfigure and manage GitHub Dependabot dependency updates through dependabot.yml files.
diShine-digital-agencyAutomate the ship cycle from branch creation to merged pull request.
VertaKhanAudits codebases and infrastructure for security vulnerabilities and produces a posture report.
berlysiaConfigure Renovate with GitHub Actions using the official guide.