gen-dependency-updater

name	gen-dependency-updater
description	Generate a Dependabot or Renovate config (`.github/dependabot.yml` or `renovate.json`) for the active stack with sensible defaults (weekly schedule, minor+patch grouping, open-PR cap at 5). Preview- before-mutate: prints the rendered config and exits without writing unless `--apply` is passed. Idempotent: same content is a no-op, different content shows a diff and refuses to overwrite without `--force-overwrite`. TRIGGER when the user says "add dependabot", "enable dependabot", "add renovate", "set up renovate", "configure dependency updates", "automate dependency updates", "scaffold dependabot.yml", "create renovate.json", "add automated dependency PRs", "wire dependency bot", "turn on dependency updates", "/nyann:gen-dependency-updater". Do NOT trigger on "update my dependencies" / "run npm update" — that's a one-off package-manager invocation, not config scaffolding. Do NOT trigger on "fix this dependabot PR" — that's a workflow inside a specific PR, not config generation.
arguments	[{"name":"updater","description":"Which generator to emit — `dependabot` (per-ecosystem YAML) or `renovate` (single JSON using `config:recommended`)."},{"name":"ecosystem","description":"Repeatable. Dependabot's `package-ecosystem` value (npm / pip / gomod / cargo / bundler / composer / maven / gradle / pub / nuget / mix / swift / docker / github-actions). `npm` covers npm/pnpm/yarn/bun. For monorepos pair with `--directory` per workspace."},{"name":"directory","description":"Repo-relative directory of the manifest, must start with `/`. Default `/` (repo root). When `--ecosystem` repeats, place `--directory` BEFORE the corresponding `--ecosystem` to associate them.","optional":true},{"name":"target","description":"Path to the repo. Required only when `--apply` is set; preview mode doesn't need it.","optional":true},{"name":"apply","description":"Write the config to the destination path. Without it, the rendered config is printed to stdout (preview).","optional":true},{"name":"force-overwrite","description":"Overwrite an existing config whose content differs from the rendered output. Without it, the script prints a diff and exits with code 3.","optional":true},{"name":"schedule","description":"How often the updater polls — `daily`, `weekly` (default), or `monthly`.","optional":true},{"name":"grouping","description":"How to bundle updates — `off` (one PR per update), `minor-patch` (default, groups minor+patch, keeps majors separate), `all` (group everything).","optional":true},{"name":"open-prs","description":"Max open dependency-updater PRs per ecosystem (1-25, default 5).","optional":true}]

gen-dependency-updater

Wraps bin/gen-dependency-updater.sh. Emits a Dependabot or Renovate config; preview-by-default; idempotent on apply.

When to trigger

• User wants automated dependency PRs and doesn't already have either config wired up.
• User wants to migrate Dependabot ↔ Renovate.
• User wants to re-generate the config after upgrading nyann (the template defaults shift with each snapshot_version).

When NOT to trigger

• User wants to manually upgrade a specific dep — that's npm install, pip install -U, cargo update, etc.
• User wants help resolving a Dependabot/Renovate PR — read the PR diff with them; this skill is for config generation only.
• User is in a non-GitHub forge — Dependabot is GitHub-specific. Renovate runs anywhere but its app installation is out of scope for this skill.

Picking updater (when the user hasn't specified)

Default to dependabot when:

• The repo is on GitHub (which is nyann's gh-integration assumption).
• The user wants minimal moving parts (Dependabot is native to GH, no app to install).

Default to renovate when:

• The user mentions multi-platform forge support.
• The user wants advanced grouping / customization (Renovate's package rules are richer than Dependabot's groups).
• The user is already a Renovate user on other repos.

When in doubt, ask:

"Dependabot is GitHub-native and zero-install — recommended for most. Renovate is more configurable but requires installing the Renovate GitHub App. Which do you want?"

Picking ecosystems

Read the StackDescriptor (from bin/detect-stack.sh) and map:

Stack hint	Ecosystem(s)
primary_language=typescript / javascript	npm
primary_language=python	pip
primary_language=go	gomod
primary_language=rust	cargo
primary_language=ruby	bundler
primary_language=php	composer
primary_language=java (Maven)	maven
primary_language=java (Gradle) / kotlin	gradle
primary_language=dart	pub
primary_language=csharp / dotnet	nuget
primary_language=elixir	mix (v1.10+)
primary_language=swift	swift
Dockerfile present	docker (in addition to language ecosystem)
.github/workflows/ present	github-actions (always recommended)

Always include github-actions even when the user didn't ask — it keeps the SAST workflow pins current.

For monorepos (workspaces resolved by bin/resolve-workspace-configs.sh), emit one --ecosystem per workspace with the workspace path as --directory. Dependabot doesn't auto-walk; one entry per manifest is mandatory.

Preview, then apply

Always preview first. Even if the user said "just do it", show the rendered config and wait for confirmation:

bin/gen-dependency-updater.sh --updater dependabot --ecosystem npm --ecosystem github-actions

Then on confirmation:

bin/gen-dependency-updater.sh --updater dependabot \
  --ecosystem npm --ecosystem github-actions \
  --target . --apply

If the destination file already exists and matches: log "unchanged" and exit. If it differs: print diff, exit 3, prompt the user before re-running with --force-overwrite.

Output

• .github/dependabot.yml (Dependabot)
• renovate.json (Renovate, at repo root)

Both files include a comment header tagging the nyann version that generated them, so a future operator can tell when to regenerate.

Defaults explained

• Schedule = weekly: Daily is noisy for most teams; monthly lets CVEs sit. Weekly balances responsiveness vs. PR-fatigue.
• Grouping = minor-patch: Bundles minor + patch into one PR per ecosystem (review-friendly). Majors stay separate because they often need breaking-change review regardless of patch size.
• open-prs = 5: Enough headroom for routine churn; raise for high-velocity repos.
• Labels = dependencies, automated: automated lets you opt these out of expensive CI matrices via label filters.

Override any of these via the corresponding flags.