docs: add Dependabot configuration documentation#20
Conversation
Document the .github/dependabot.yml configuration file that was added in commit 30d356b. This fills a documentation gap by explaining: - What Dependabot monitors (GitHub Actions) - Update schedule (weekly on Mondays) - Configuration options and customization - Supported package ecosystems - Link to official GitHub documentation Also adds cross-reference from automation-overview.md to the detailed configuration documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
zircote
left a comment
There was a problem hiding this comment.
Documentation update looks good.
There was a problem hiding this comment.
Pull request overview
Adds documentation describing the repository’s Dependabot configuration (.github/dependabot.yml) and links it from the automation overview so contributors can understand/adjust dependency update monitoring.
Changes:
- Documented the current Dependabot config (ecosystem, schedule, grouping, labels, reviewers) in
docs/workflow-reference.md. - Added a short Dependabot configuration summary and cross-reference link in
docs/automation-overview.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| docs/workflow-reference.md | New “Dependabot Configuration” section with config walkthrough and customization guidance. |
| docs/automation-overview.md | Adds a brief Dependabot configuration summary and link to the detailed reference section. |
|
|
||
| **Automatic behaviors:** | ||
| - Groups minor and patch updates into a single PR when possible | ||
| - Applies `dependencies` and `github-actions` labels |
There was a problem hiding this comment.
The docs say Dependabot “applies dependencies and github-actions labels”, but this repo’s .github/labels.yml doesn’t define either label. If label sync is used, these labels won’t exist and Dependabot won’t be able to apply them. Consider either adding these labels to .github/labels.yml or adding a note here that the labels must exist in the repo before Dependabot can apply them.
| - Applies `dependencies` and `github-actions` labels | |
| - Applies `dependencies` and `github-actions` labels if they exist in the repository (ensure they are defined in `.github/labels.yml` when using label sync) |
| **Supported ecosystems:** | ||
| - `github-actions` - GitHub Actions workflows | ||
| - `npm` - JavaScript/Node.js | ||
| - `pip` - Python | ||
| - `docker` - Docker images | ||
| - `composer` - PHP | ||
| - `maven` - Java/Maven | ||
| - `gradle` - Java/Gradle | ||
| - `bundler` - Ruby | ||
| - `cargo` - Rust | ||
| - `gomod` - Go modules |
There was a problem hiding this comment.
This “Supported ecosystems” list looks like it’s intended to be comprehensive, but it omits several Dependabot ecosystems (e.g., nuget, terraform, gitsubmodule, etc.). To avoid stale/inaccurate docs, either clarify that this is a non-exhaustive list of common ecosystems or replace it with a link/summary that points readers to the official GitHub list for the complete set.
| Dependabot is configured in `.github/dependabot.yml` to: | ||
| - Check for GitHub Actions updates weekly (Mondays at 9 AM Central) | ||
| - Group minor and patch updates together | ||
| - Apply `dependencies` and `github-actions` labels automatically | ||
|
|
There was a problem hiding this comment.
This section says Dependabot applies both dependencies and github-actions labels, but later in the same doc the “Workflow Labels” table only documents the dependencies label. Consider documenting github-actions there as well (or adjusting this bullet) so the labeling story stays consistent for readers.
Summary
Adds comprehensive documentation for the
.github/dependabot.ymlconfiguration file that was introduced in commit 30d356b.Changes Made
Documentation Updates
workflow-reference.md - Added new "Dependabot Configuration" section including:
automation-overview.md - Enhanced "Dependabot Auto-Merge" section with:
Documentation Gap Addressed
Prior to these changes, the documentation covered:
But was missing:
.github/dependabot.ymlconfiguration file itselfThis PR fills that documentation gap.
Testing
.github/dependabot.ymlRelated Files
.github/dependabot.yml- Configuration file being documenteddocs/workflow-reference.md- Primary documentation updatedocs/automation-overview.md- Cross-reference addedNote: This is a documentation-only change with no functional impact.