---
name: "dependabot-configuration-ecosystems"
description: "Configure automated dependency version bumps and security vulnerability hotfixes via Dependabot."
metadata:
  author: "Dependabot"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "configure dependabot.yml"
  - "enable dependabot docker updates"
  - "dependabot open-pull-requests-limit"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# GitHub Dependabot Security & Version Update Rules

Configures .github/dependabot.yml: defining package-ecosystem (npm, pip, docker, terraform), open-pull-requests-limit, rebase strategies, ignore rules, and scoping security advisories.

## When to Invoke
Invoke this skill whenever you need to:
- configure dependabot.yml
- enable dependabot docker updates
- dependabot open-pull-requests-limit

## Execution SOP & Rules
1. Create .github/dependabot.yml specifying version: 2.
2. Add updates: - package-ecosystem: 'npm', directory: '/', schedule: { interval: 'weekly' }.
3. Add ecosystems for 'docker' and 'github-actions' to keep base images and CI actions fresh.
4. Inspect Dependabot tab in GitHub repository settings to review active dependency graphs.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.