Update dependabot.yml

# 🛠️ Custom `dependabot.yml` for Node.js, Python, Docker, and GitHub Actions

Below is a tailored Dependabot configuration for a repository that uses **Node.js**, **Python**, **Docker**, and **GitHub Actions**. Adjust the `directory` paths to match your actual project layout.

## 📁 Assumed Project Structure

```
.
├── .github/
│   └── workflows/           # GitHub Actions workflows
├── frontend/                 # Node.js application (if separate)
│   ├── package.json
│   └── ...
├── backend/                  # Python application (if separate)
│   ├── requirements.txt
│   └── ...
├── Dockerfile                # If Dockerfile is in root
├── requirements.txt          # If Python deps are in root
├── package.json              # If Node.js deps are in root
└── ...
```

## 🔧 `dependabot.yml` Configuration

Create the file at `.github/dependabot.yml` with the following content:

```yaml
version: 2
updates:
  # 1. Node.js (npm) dependencies
  - package-ecosystem: "npm"
    # Adjust directory if your package.json is in a subfolder
    directory: "/"                     # root, or "/frontend", "/backend" etc.
    schedule:
      interval: "weekly"                # daily, weekly, monthly
      day: "monday"                     # optional
      time: "09:00"                      # UTC
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "javascript"
    reviewers:
      - "your-github-username"           # optional: assign reviewers
    commit-message:
      prefix: "chore(deps)"
      prefix-development: "chore(deps-dev)"

  # 2. Python (pip) dependencies
  - package-ecosystem: "pip"
    directory: "/"                     # root, or "/backend"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "python"
    reviewers:
      - "your-github-username"
    # For pip, you can also specify a requirements file pattern
    # requirements: "requirements.txt"  # if not in default location
    commit-message:
      prefix: "chore(deps-pip)"

  # 3. Docker
  - package-ecosystem: "docker"
    directory: "/"                     # location of Dockerfile
    schedule:
      interval: "monthly"               # base images change less often
    labels:
      - "dependencies"
      - "docker"
    commit-message:
      prefix: "chore(docker)"

  # 4. GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"                     # looks in .github/workflows
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"
      - "github-actions"
    commit-message:
      prefix: "chore(actions)"
```

## 🔍 Explanation of Options

- **`package-ecosystem`**: Identifies the dependency manager.
- **`directory`**: The directory where the manifest files are located. For GitHub Actions, it's always `/` (the root) because it scans `.github/workflows`.
- **`schedule`**: How often Dependabot checks for updates. Choose `daily`, `weekly`, or `monthly`. You can also specify `day` and `time`.
- **`open-pull-requests-limit`**: Max number of open PRs Dependabot will create at once (prevents flooding).
- **`labels`**: Labels to add to PRs (useful for filtering and automation).
- **`reviewers` / `assignees`**: GitHub usernames or team names to auto-assign.
- **`commit-message`**: Customise the commit message prefix.

## 🧩 Customising for Your Project

- If your **Node.js** and **Python** dependencies are in the **root**, set both directories to `/`.
- If they are in separate subfolders (e.g., `frontend` and `backend`), change the `directory` accordingly:
  ```yaml
  - package-ecosystem: "npm"
    directory: "/frontend"
  - package-ecosystem: "pip"
    directory: "/backend"
  ```
- For **Docker**, if you have multiple Dockerfiles in different directories, you can add separate blocks for each.

## 🚀 Enabling Dependabot

1. Commit the `.github/dependabot.yml` file to your default branch.
2. Ensure **Dependabot alerts** and **Dependabot security updates** are enabled in your repository settings (Settings → Code security and analysis).
3. Dependabot will run within 24 hours and create PRs based on your schedule.

## ✅ Best Practices

- Start with `open-pull-requests-limit: 5` if you're new to Dependabot.
- Use **labels** to easily filter PRs in your CI (e.g., only run certain tests on dependency PRs).
- Combine with **GitHub Actions** to automatically run tests on Dependabot PRs (Dependabot PRs have `github.actor == 'dependabot[bot]'`).
- Consider using **`versioning-strategy`** for npm: `increase` updates both `package.json` and `package-lock.json`; `lockfile-only` only updates the lockfile.

Need adjustments for your specific folder layout? Let me know! 😊
# 🔄 Enhanced `dependabot.yml` with Advanced Features

You asked for "Again" – let's take Dependabot configuration to the next level! Below is an **advanced, production-ready** configuration for your Node.js, Python, Docker, and GitHub Actions stack. It includes grouping, ignore rules, custom labels, and settings to work seamlessly with your CI.

## 📁 Advanced `dependabot.yml`

```yaml
version: 2
updates:
  # -------------------- Node.js (npm) --------------------
  - package-ecosystem: "npm"
    directory: "/"                     # or "/frontend"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "Asia/Kuala_Lumpur"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "javascript"
      - "automerge"                    # if you use auto-merge workflows
    reviewers:
      - "your-username"
    assignees:
      - "your-username"
    # Group all minor/patch updates together
    groups:
      minor-and-patch:
        applies-to: version-updates
        update-types:
          - "minor"
          - "patch"
        patterns:
          - "*"
    # Ignore major updates for certain packages
    ignore:
      - dependency-name: "react"
        versions: [ ">=18.x" ]
      - dependency-name: "express"
        versions: [ "5.x" ]
    versioning-strategy: increase       # updates package.json as well
    commit-message:
      prefix: "chore(deps)"
      prefix-development: "chore(deps-dev)"
      include: "scope"                  # includes dependency name

  # -------------------- Python (pip) --------------------
  - package-ecosystem: "pip"
    directory: "/"                     # or "/backend"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "python"
    reviewers:
      - "your-username"
    groups:
      python-minor-patch:
        applies-to: version-updates
        update-types:
          - "minor"
          - "patch"
        patterns:
          - "*"
    ignore:
      - dependency-name: "django"
        versions: [ ">=4.0" ]
    # For pip, you can specify requirements files explicitly
    # requirements: "requirements.txt"
    commit-message:
      prefix: "chore(deps-pip)"

  # -------------------- Docker --------------------
  - package-ecosystem: "docker"
    directory: "/"                     # where Dockerfile lives
    schedule:
      interval: "monthly"               # base images change less often
    labels:
      - "dependencies"
      - "docker"
    commit-message:
      prefix: "chore(docker)"
    ignore:
      - dependency-name: "node"
        versions: [ ">=20" ]            # if you want to stick to older LTS

  # -------------------- GitHub Actions --------------------
  - package-ecosystem: "github-actions"
    directory: "/"                     # always root
    schedule:
      interval: "weekly"
    labels:
      - "dependencies"
      - "github-actions"
    commit-message:
      prefix: "chore(actions)"
```

## 🧠 Advanced Features Explained

### **1. Grouping Updates**
```yaml
groups:
  minor-and-patch:
    applies-to: version-updates
    update-types: ["minor", "patch"]
    patterns: ["*"]
```
- Groups all minor and patch updates into a **single pull request**. This reduces PR noise.
- You can create multiple groups (e.g., `major-updates`, `security-only`).

### **2. Ignoring Certain Versions**
```yaml
ignore:
  - dependency-name: "react"
    versions: [ ">=18.x" ]
```
- Prevents Dependabot from suggesting updates to React 18+ if you're not ready.

### **3. Timezone Support**
```yaml
timezone: "Asia/Kuala_Lumpur"
```
- Ensures the schedule runs at a sensible local time.

### **4. Commit Message Customisation**
```yaml
commit-message:
  prefix: "chore(deps)"
  include: "scope"
```
- Adds the dependency name to the commit message, e.g., `chore(deps): bump lodash from 4.17.20 to 4.17.21`.

### **5. Security Updates**
Dependabot also automatically opens PRs for **security vulnerabilities** – these are **not** controlled by `dependabot.yml`. They appear separately as "security" PRs with the label `security`. You can enable/disable them in repository settings.

## 🤖 Automating Dependabot PRs with GitHub Actions

You can automatically **approve and merge** Dependabot PRs that pass tests. Here's a simple workflow (`.github/workflows/auto-merge.yml`):

```yaml
name: Auto-merge Dependabot PRs

on: pull_request_target

permissions:
  pull-requests: write
  contents: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Approve PR
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Enable auto-merge
        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
        run: gh pr merge --auto --merge "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
```

This workflow:
- Approves any Dependabot PR.
- Auto-merges if it's a patch or minor update (after CI passes).

## 🧪 Testing Dependabot Locally

You can't run Dependabot locally, but you can **manually trigger** a version update check using the GitHub CLI:

```bash
gh api -X POST /repos/{owner}/{repo}/dependabot/updates -f "package-ecosystem=npm" -f "directory=/" -f "schedule.interval=weekly"
```

This is useful for testing after changing `dependabot.yml`.

## 📌 Next Steps

1. **Copy the enhanced config** into `.github/dependabot.yml`.
2. **Adjust directories** and **ignore rules** to match your project.
3. **Commit and push** to your default branch.
4. **Monitor** the first run (within 24 hours) – check the **Insights → Dependency graph → Dependabot** tab.

Need further customisation? Let me know! 😊

Author: Muhamad Sazwan Bin Ismail

.github/dependabot.yml

@@ -45,3 +45,135 @@ updates:
           - '*'
     ignore:
       - dependency-name: 'node' # Ignore Dockerfile.openapi_decorator
+# 📦 Dependabot Configuration (`dependabot.yml`)
+
+**Dependabot** is GitHub's automated dependency update tool. It scans your repository for outdated dependencies and opens pull requests to update them. It supports many ecosystems (npm, pip, Maven, Gradle, Docker, GitHub Actions, etc.) and is configured via a `dependabot.yml` file placed in the `.github` directory.
+
+## 📁 File Location
+
+Create the file at:
+```
+.github/dependabot.yml
+```
+
+## ⚙️ Basic Configuration
+
+Here is a minimal configuration for a Node.js project with dependencies checked weekly:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"                # see below for ecosystem list
+    directory: "/"                           # location of package.json
+    schedule:
+      interval: "weekly"                      # daily, weekly, monthly
+```
+
+## 📋 Common Package Ecosystems
+
+| Ecosystem        | `package-ecosystem` value | Example files           |
+|------------------|---------------------------|-------------------------|
+| npm / yarn       | `npm`                     | package.json, package-lock.json |
+| pip              | `pip`                     | requirements.txt, pyproject.toml |
+| Maven            | `maven`                   | pom.xml                 |
+| Gradle           | `gradle`                  | build.gradle, build.gradle.kts |
+| Docker           | `docker`                  | Dockerfile              |
+| GitHub Actions   | `github-actions`          | `.github/workflows/*.yml` |
+| Composer         | `composer`                | composer.json           |
+| Bundler          | `bundler`                 | Gemfile                 |
+| Cargo            | `cargo`                   | Cargo.toml              |
+| Go modules       | `gomod`                   | go.mod                  |
+| Terraform        | `terraform`               | *.tf files              |
+| NuGet            | `nuget`                   | *.csproj, *.sln         |
+
+## 🔧 Advanced Configuration Options
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "09:00"               # 9 AM UTC
+      timezone: "Asia/Kuala_Lumpur"
+    open-pull-requests-limit: 10   # max open PRs at any time
+    labels:
+      - "dependencies"
+      - "npm"
+    reviewers:
+      - "username"                 # GitHub username
+      - "my-team"                   # team name
+    assignees:
+      - "username"
+    milestone: 5                    # milestone number
+    versioning-strategy: increase   # or lockfile-only (for npm)
+    allow:
+      - dependency-type: "direct"   # only direct dependencies
+    ignore:
+      - dependency-name: "express"
+        versions: ["4.x", "5.x"]    # ignore specific versions
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(deps-dev)"
+    target-branch: "develop"         # target branch for PRs
+```
+
+## 🧩 Example for a Multi‑Ecosystem Project
+
+Suppose your project has a Node.js frontend, a Python backend, and uses Docker and GitHub Actions. You can configure multiple update blocks:
+
+```yaml
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+```
+
+## 🔒 Security Updates vs Version Updates
+
+- **Version updates**: Dependabot checks for newer versions and opens PRs based on your schedule. This must be enabled in the repository settings.
+- **Security updates**: GitHub automatically opens PRs for vulnerable dependencies regardless of schedule. They appear as "security" PRs.
+
+To enable version updates, you must have `dependabot.yml` and ensure the feature is enabled in the repository (Settings → Code security and analysis → Dependabot version updates).
+
+## 🚀 Enabling Dependabot on GitHub
+
+1. Go to your repository on GitHub.
+2. Click **Settings** → **Code security and analysis**.
+3. Under **Dependabot**, enable **Dependabot alerts** and **Dependabot security updates**.
+4. For version updates, you need the `dependabot.yml` file; GitHub will automatically pick it up.
+
+## 💡 Tips & Best Practices
+
+- **Start with `open-pull-requests-limit`** to avoid flooding your PR list.
+- **Use `labels` and `reviewers`** to automate assignment.
+- For monorepos, set multiple update blocks pointing to different subdirectories.
+- **Combine with GitHub Actions** – Dependabot PRs can trigger your CI workflows to test the updates.
+- **Ignore major updates** if you're not ready, using the `ignore` option.
+- **Monitor Dependabot logs**: GitHub provides logs under **Insights** → **Dependency graph** → **Dependabot**.
+
+## 📚 Official Documentation
+
+For a full reference, see [GitHub Dependabot documentation](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file).
+
+---
+
+Would you like me to create a `dependabot.yml` tailored specifically to your project stack (Node.js, Python, Docker, GitHub Actions)? Just tell me the folders and ecosystems!