What problem does it solve? Dependabot PRs often fail silently: lanes point at directories with no manifests, lockfiles go stale under frozen-lockfile CI, and App-token workflows break in public repos where org secrets cannot resolve. This Skill detects a repo's actual ecosystems and renders a correct, grouped .github/dependabot.yml plus the supporting auto-merge and lockfile-sync workflows, then validates every lane against the repo before writing. ## Core Features & Use Cases - Ecosystem detection probe: Scans tracked repo files to detect npm, bun, cargo, gradle, pub, nuget, pip, gomod, swift, docker, and cocoapods, reporting the exact directory of each manifest and flagging lockfile risk. - Scripted render with post-render validation: Renders one Dependabot lane per (ecosystem, directory) pair from templates, then asserts every declared directory actually holds its manifest and reports diverged lanes instead of silently dropping them. - Merge-gate and visibility preconditions: Probes branch protection, rulesets, and repo visibility before rendering auto-merge or lockfile-sync workflows, refusing to emit App-token workflows into public repos. - Use Case: A monorepo with npm workspaces, a Flutter app, and a Rust workspace asks to "set up Dependabot" — the Skill detects each ecosystem at its real directory, renders grouped lanes, and skips the auto-merge workflow because the repo is public, reporting the manual lockfile path instead. ## Quick Start Ask the agent to set up Dependabot and dependency auto-merge for this repository, and it will detect the stack, render the config, and validate it before writing.
