Context
The governance scan (2026-08-21) found dependabot.yml present in only 3 of 10 repositories.
Current state:
- Have dependabot.yml: unbound-force, replicator, intake-kit
- Missing dependabot.yml: .github, gaze, dewey, website, homebrew-tap, containerfile
Action
Add a .github/dependabot.yml to each repo. Suggested template (adapt ecosystem per repo):
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
commit-message:
prefix: ci
include: scope
- package-ecosystem: gomod # or npm, pip, etc.
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 10
commit-message:
prefix: chore
include: scope
Per-repo ecosystems:
| Repo |
Ecosystems |
| .github |
github-actions, gomod |
| gaze |
github-actions, gomod |
| dewey |
github-actions, gomod |
| website |
github-actions (+ framework-specific) |
| homebrew-tap |
github-actions |
| containerfile |
github-actions |
Acceptance Criteria
Context
The governance scan (2026-08-21) found dependabot.yml present in only 3 of 10 repositories.
Current state:
Action
Add a
.github/dependabot.ymlto each repo. Suggested template (adapt ecosystem per repo):Per-repo ecosystems:
Acceptance Criteria