fix-dependabot.sh

#!/usr/bin/env bash
# SPDX-License-Identifier: MPL-2.0
#
# fix-dependabot.sh — Auto-create .github/dependabot.yml with detected ecosystems
#
# Category: DependencyUpdate
# Usage: fix-dependabot.sh <repo-path> <finding-json>
#
# Idempotent: exits 0 if dependabot.yml already exists.
# Does NOT commit — dispatch-runner handles that.

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true

REPO_PATH="${1:?Usage: fix-dependabot.sh <repo-path> <finding-json>}"
FINDING_JSON="${2:?Usage: fix-dependabot.sh <repo-path> <finding-json>}"

# --- Idempotency check ---
if [[ -f "${REPO_PATH}/.github/dependabot.yml" ]] || \
   [[ -f "${REPO_PATH}/.github/dependabot.yaml" ]]; then
  echo "[fix-dependabot] dependabot.yml already exists — skipping."
  exit 0
fi

# --- Detect ecosystems ---
declare -a ECOSYSTEMS=()

if [[ -f "${REPO_PATH}/Cargo.toml" ]]; then
  ECOSYSTEMS+=("cargo")
fi

if [[ -f "${REPO_PATH}/mix.exs" ]]; then
  ECOSYSTEMS+=("mix")
fi

if [[ -f "${REPO_PATH}/package.json" ]]; then
  ECOSYSTEMS+=("npm")
fi

if [[ -f "${REPO_PATH}/Gemfile" ]]; then
  ECOSYSTEMS+=("bundler")
fi

if [[ -f "${REPO_PATH}/requirements.txt" ]] || [[ -f "${REPO_PATH}/setup.py" ]]; then
  ECOSYSTEMS+=("pip")
fi

if [[ -f "${REPO_PATH}/go.mod" ]]; then
  ECOSYSTEMS+=("gomod")
fi

# Always include github-actions
ECOSYSTEMS+=("github-actions")

# --- Create .github directory if needed ---
mkdir -p "${REPO_PATH}/.github"

# --- Generate dependabot.yml ---
{
  cat <<'HEADER'
# SPDX-License-Identifier: MPL-2.0
# Auto-generated by fix-dependabot.sh (gitbot-fleet)
version: 2
updates:
HEADER

  for eco in "${ECOSYSTEMS[@]}"; do
    # github-actions uses a different directory
    if [[ "${eco}" == "github-actions" ]]; then
      directory="/"
    else
      directory="/"
    fi

    if [[ "${eco}" == "github-actions" ]]; then
      limit=2
      group=actions
    else
      limit=3
      group=dependency-updates
    fi

    cat <<EOF
  - package-ecosystem: "${eco}"
    directory: "${directory}"
    schedule:
      interval: "weekly"
    target-branch: "main"
    open-pull-requests-limit: ${limit}
    groups:
      ${group}:
        patterns: ["*"]
EOF
  done
} > "${REPO_PATH}/.github/dependabot.yml"

echo "[fix-dependabot] Created .github/dependabot.yml with ecosystems: ${ECOSYSTEMS[*]}"