| name | dependabot-config-hardening |
| description | Harden GitHub Dependabot: complete .github/dependabot.yml coverage, safe schedules and groups, PR limits, private registries, ignore expiry, monorepo directories, Actions and Docker updates, and review/CI gates without blind auto-merge. Use when dependabot.yml, Dependabot security updates, package ecosystem entries, update grouping, open-pull-requests-limit, dependabot ignore, private registries, vendor allow, versioning-strategy, or hardening dependency bots on GitHub — hand pin/lock strategy to dependency-pinning-strategies and Renovate-only presets to that bot’s docs.
|
Dependabot Config Hardening
Own Dependabot YAML and update policy: full ecosystem coverage, grouped
noise, secret-safe registries, and bot PRs that still pass checks and review—not lockfile pin theory or full SBOM/CVE inventory.
When To Use
- Authoring or auditing
.github/dependabot.yml / dependabot.yaml
- Enabling or tuning version and security updates per ecosystem
- Monorepo multi-
directory / multi-package-ecosystem coverage gaps
- Groups, schedules,
open-pull-requests-limit, cooldown, or PR thrash
- Private registries, vendor/allowlists,
insecure-external-code-execution
- Mentions: Dependabot, dependabot.yml, security updates, dependency bot,
grouped updates, Actions bumps, Docker updates via Dependabot
Do not use as primary for:
| Need | Skill instead |
|---|
| Lockfiles, exact vs range, frozen CI | dependency-pinning-strategies |
| Registry namespace / typosquat confusion | dependency-confusion |
| SBOM, SCA/CVE, provenance, CI gates | sbom-and-supply-chain / sbom-ci-enforcement |
| Branch required checks / admin bypass | branch-protection-rules |
| CODEOWNERS path reviewers | codeowners-review-routing |
| Full pipeline shape / secrets in CI | ci-cd-pipeline-patterns |
| Renovate-only presets (no Dependabot) | document Renovate; keep this for GH Dependabot |
Repo Config First
Org and repo policy outrank defaults below.
- Active config path:
.github/dependabot.yml (or .yaml); single source of truth
- Org Dependabot settings: security updates, dependency graph, private registry secrets
- Ecosystems present: npm/yarn/pnpm, pip/poetry/uv, bundler, cargo, gomod, maven/gradle, nuget, composer, docker, github-actions, terraform, etc.
- Monorepo roots: workspace dirs, nested manifests/Dockerfiles — map each
directory
- Branch protection: required checks, code owners, bot merge permissions
- Existing ignore / pin debt: eternal ignores, force-merge culture, dual Dependabot+Renovate conflicts
- Neighbors: lockfiles, CODEOWNERS on lock/manifests, SCA workflows
Precedence: Follow live org Dependabot + repo YAML. Flag configs that omit
ecosystems, float Actions by mutable tags only, auto-merge majors without CI, or
store registry passwords in plaintext YAML.
Workflow
1. Inventory coverage
| Check | Hardening target |
|---|
| Each deployable manifest root | Explicit package-ecosystem + directory |
.github/workflows | github-actions at / (or workflow root) |
| Root and service Dockerfiles | docker per directory that owns the file |
| Missing lock/manifest pairs | Fix pins first (dependency-pinning-strategies) |
Prefer one bot for version PRs unless org splits security-only Dependabot from Renovate—never two bots fighting the same lockfile.
2. Schedule, limits, and grouping
- Interval: weekly default; daily only when noise and CI capacity allow.
open-pull-requests-limit: bound the queue (e.g. 5–15) so reviews stay feasible.- Groups: batch patch/minor by ecosystem or app directory; keep major ungrouped or separate.
- Day/timezone: align with review windows; avoid unplanned Friday major dumps.
- Cooldown (when available): reduce flapping on rapid successive releases.
3. Versioning, ignores, and allow rules
versioning-strategy: match app vs library policy; apps usually favor lockfile-driven updates.ignore: temporary only—record reason + review date; eternal ignores are silent CVE debt.allow / dependency-type: optionally limit to direct deps if transitive noise dominates; do not drop security coverage without SCA elsewhere.vendor: true: only when the repo truly vendors and CI understands vendor diffs.insecure-external-code-execution: leave denied unless a documented ecosystem requires it.
4. Registries and secrets
- Define
registries: for private npm, Maven, Docker, NuGet, etc.; reference by name from each update entry.
- Store tokens in GitHub Dependabot secrets, never in committed YAML or public fork logs.
- Scope tokens read-only; rotate on leak; pair with
dependency-confusion defenses.
- Confirm private deps resolve without leaking creds into PR bodies or logs.
5. PR quality and merge gates
- Reviewers / assignees / labels: route to owning teams; label
dependencies for filters.
- Commit message prefix: align with
commit-message-conventions when using Conventional Commits.
- Target branch: default trunk unless a release-train exception is documented.
- No blind auto-merge of majors, install-script packages, or Actions majors without green checks and owner review (
branch-protection-rules).
- Prefer grouped patches with solid CI over force-merged single-dep spam.
6. Ecosystem notes and verify
| Ecosystem | Notes |
|---|
| github-actions | Prefer SHA-pinned actions; review third-party trust on bumps |
| docker | Pin digests where policy requires; review base image CVE notes |
| npm / pnpm / yarn | One entry per meaningful workspace directory; avoid duplicate thrash |
| gomod / cargo / pip | Lock/sum committed; bot PRs must keep frozen CI green |
| terraform | Module/provider updates separate from app language ecosystems |
Verify: Dependabot UI healthy (no auth errors); sample security/version PRs hit required checks; private registry resolves without secret echo; groups and ignore expiry documented.
Routing
| Situation | Primary | Helper |
|---|
| dependabot.yml, groups, limits, registries, security vs version updates | This skill | — |
| Lock/pin policy, frozen install, exact vs range | dependency-pinning-strategies | this for bot YAML |
| Typosquat / wrong registry host | dependency-confusion | registry blocks here |
| SBOM / CVE inventory | sbom-and-supply-chain | this for update cadence |
| Required checks, bot merge rights | branch-protection-rules | this for PR shape |
| Who reviews lock/manifest paths | codeowners-review-routing | this for labels/reviewers |
| CI install and cache keys | ci-cd-pipeline-patterns | frozen install + bot PRs |
| Config/manifest quality | code-quality-standards | always on YAML edits |
Hand-offs: Pin/lock → dependency-pinning-strategies; SCA/SBOM → sbom-and-supply-chain; protection → branch-protection-rules. Keep this skill primary for Dependabot YAML hardening.
Output Checklist
