如何为多仓库自动化生成Dependabot配置文件？

Dependabot原生配置不支持目录通配符，但可以通过以下几种方式实现类似效果，避免手动重复配置或低效克隆仓库：

1. 用GitHub Actions自动生成Dependabot配置 #

不需要克隆整个仓库，直接通过Actions扫描仓库目录结构，自动生成dependabot.yml，相当于实现通配符匹配的效果：

示例Workflow #

name: Generate Dependabot Config
on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * 0' # 每周日自动更新配置

jobs:
  generate-config:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: Scan package directories
        id: scan-dirs
        run: |
          # 扫描所有npm包目录（排除node_modules）
          NPM_DIRS=$(find . -name "package.json" -not -path "./node_modules/*" | xargs dirname | sed 's|^\./|/|')
          # 扫描所有cargo包目录（排除target）
          CARGO_DIRS=$(find . -name "Cargo.toml" -not -path "./target/*" | xargs dirname | sed 's|^\./|/|')
          # 输出结果供后续步骤使用
          echo "npm_dirs<<EOF" >> $GITHUB_OUTPUT
          echo "$NPM_DIRS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
          echo "cargo_dirs<<EOF" >> $GITHUB_OUTPUT
          echo "$CARGO_DIRS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Generate dependabot.yml
        run: |
          # 初始化配置文件
          cat > .github/dependabot.yml << EOF
          version: 2
          updates:
          EOF
          # 添加所有npm目录的更新规则
          for dir in ${{ steps.scan-dirs.outputs.npm_dirs }}; do
            cat >> .github/dependabot.yml << EOF
          - package-ecosystem: npm
            directory: "$dir"
            schedule:
              interval: daily
          EOF
          done
          # 添加所有cargo目录的更新规则
          for dir in ${{ steps.scan-dirs.outputs.cargo_dirs }}; do
            cat >> .github/dependabot.yml << EOF
          - package-ecosystem: cargo
            directory: "$dir"
            schedule:
              interval: daily
          EOF
          done

      - name: Commit and push changes
        uses: EndBug/add-and-commit@v9
        with:
          message: "Auto-generate dependabot config"
          add: ".github/dependabot.yml"

2. 批量仓库配置：用GitHub API直接推送模板 #

如果要给大量仓库统一配置，不需要逐个克隆，直接通过GitHub API修改仓库的dependabot.yml，速度更快：

示例Python脚本 #

import requests
import json
import base64

GITHUB_TOKEN = "your-github-token"
ORG_NAME = "your-organization"
# 可通过API获取组织内所有仓库，这里手动指定示例仓库列表
REPOS = ["repo-1", "repo-2", "repo-3"]

# 单语言仓库配置模板
single_lang_template = """version: 2
updates:
- package-ecosystem: npm
  directory: "/"
  schedule:
    interval: daily
"""

# Monorepo仓库配置模板（模拟通配符效果）
monorepo_template = """version: 2
updates:
- package-ecosystem: npm
  directory: "/sites/a"
  schedule:
    interval: daily
- package-ecosystem: npm
  directory: "/sites/b"
  schedule:
    interval: daily
- package-ecosystem: cargo
  directory: "/package/a"
  schedule:
    interval: daily
- package-ecosystem: cargo
  directory: "/package/b"
  schedule:
    interval: daily
"""

for repo in REPOS:
    config_url = f"https://api.github.com/repos/{ORG_NAME}/{repo}/contents/.github/dependabot.yml"
    headers = {"Authorization": f"token {GITHUB_TOKEN}", "Accept": "application/vnd.github.v3+json"}
    
    # 检查现有配置是否存在
    response = requests.get(config_url, headers=headers)
    template_to_use = monorepo_template if "monorepo" in repo else single_lang_template
    encoded_content = base64.b64encode(template_to_use.encode()).decode()
    
    if response.status_code == 200:
        # 更新现有配置
        existing_sha = response.json()["sha"]
        data = {
            "message": "Update dependabot config",
            "content": encoded_content,
            "sha": existing_sha
        }
    else:
        # 创建新配置
        data = {
            "message": "Add dependabot config",
            "content": encoded_content
        }
    
    requests.put(config_url, headers=headers, data=json.dumps(data))

3. 用分组功能简化配置维护 #

如果同类型目录的更新规则一致，可以用groups字段将它们归为一组，后续调整规则只需修改分组配置：

version: 2
updates:
- package-ecosystem: npm
  directory: "/sites/a"
  schedule:
    interval: daily
  groups:
    sites-npm-packages:
      patterns: ["*"]
- package-ecosystem: npm
  directory: "/sites/b"
  schedule:
    interval: daily
  groups:
    sites-npm-packages:
      patterns: ["*"]

原问题背景 #

需要为大量仓库配置Dependabot，手动配置耗时极久。部分仓库为单语言类型（如使用单个package.json的TypeScript仓库，对应package-ecosystem: npm），其他则为Monorepo，包含多种语言及不同层级的包管理器。由于dependabot.yml需配置对应根目录和包生态，无法复用单一配置文件。尝试通过脚本实现，但克隆大量仓库速度慢且易出错。

现有复杂Dependabot配置示例：

version: 2
updates:
- package-ecosystem: cargo
  directory: "/package/a"
  schedule:
    interval: daily
- package-ecosystem: cargo
  directory: "/package/b"
  schedule:
    interval: daily
- package-ecosystem: cargo
  directory: "/package/c"
  schedule:
    interval: daily
- package-ecosystem: npm
  directory: "/sites/a"
  schedule:
    interval: daily
- package-ecosystem: npm
  directory: "/sites/b"
  schedule:
    interval: daily
... 20 other roots

期望的简化配置（类通配符效果）：

- package-ecosystem: npm
  directory: "/sites/*" <<<<<< some wild card / pattern matching here?
  schedule:
    interval: daily
- package-ecosystem: cargo
  directory: "/package/*"
  schedule:
    interval: daily

内容的提问来源于stack exchange，提问作者Avba