Gen Dependency Updater

---
name: gen-dependency-updater
description: >
  Generate a Dependabot or Renovate config (`.github/dependabot.yml`
  or `renovate.json`) for the active stack with sensible defaults
  (weekly schedule, minor+patch grouping, open-PR cap at 5). Preview-
  before-mutate: prints the rendered config and exits without writing
  unless `--apply` is passed. Idempotent: same content is a no-op,
  different content shows a diff and refuses to overwrite without
  `--force-overwrite`.
  TRIGGER when the user says "add dependabot", "enable dependabot",
  "add renovate", "set up renovate", "configure dependency updates",
  "automate dependency updates", "scaffold dependabot.yml", "create
  renovate.json", "add automated dependency PRs", "wire dependency
  bot", "turn on dependency updates", "/nyann:gen-dependency-updater".
  Do NOT trigger on "update my dependencies" / "run npm update" —
  that's a one-off package-manager invocation, not config scaffolding.
  Do NOT trigger on "fix this dependabot PR" — that's a workflow
  inside a specific PR, not config generation.
arguments:
  - name: updater
    description: Which generator to emit — `dependabot` (per-ecosystem YAML) or `renovate` (single JSON using `config:recommended`).
  - name: ecosystem
    description: Repeatable. Dependabot's `package-ecosystem` value (npm / pip / gomod / cargo / bundler / composer / maven / gradle / pub / nuget / mix / swift / docker / github-actions). `npm` covers npm/pnpm/yarn/bun. For monorepos pair with `--directory` per workspace.
  - name: directory
    description: Repo-relative directory of the manifest, must start with `/`. Default `/` (repo root). When `--ecosystem` repeats, place `--directory` BEFORE the corresponding `--ecosystem` to associate them.
    optional: true
  - name: target
    description: Path to the repo. Required only when `--apply` is set; preview mode doesn't need it.
    optional: true
  - name: apply
    description: Write the config to the destination path. Without it, the rendered config is printed to stdout (preview).
    optional: true
  - name: force-overwrite
    description: Overwrite an existing config whose content differs from the rendered output. Without it, the script prints a diff and exits with code 3.
    optional: true
  - name: schedule
    description: How often the updater polls — `daily`, `weekly` (default), or `monthly`.
    optional: true
  - name: grouping
    description: How to bundle updates — `off` (one PR per update), `minor-patch` (default, groups minor+patch, keeps majors separate), `all` (group everything).
    optional: true
  - name: open-prs
    description: Max open dependency-updater PRs per ecosystem (1-25, default 5).
    optional: true
---

# gen-dependency-updater

Wraps `bin/gen-dependency-updater.sh`. Emits a Dependabot or Renovate
config; preview-by-default; idempotent on apply.

## When to trigger

- User wants automated dependency PRs and doesn't already have either
  config wired up.
- User wants to migrate Dependabot ↔ Renovate.
- User wants to re-generate the config after upgrading nyann (the
  template defaults shift with each `snapshot_version`).

## When NOT to trigger

- User wants to **manually upgrade** a specific dep — that's
  `npm install`, `pip install -U`, `cargo update`, etc.
- User wants help **resolving** a Dependabot/Renovate PR — read the
  PR diff with them; this skill is for config generation only.
- User is in a non-GitHub forge — Dependabot is GitHub-specific.
  Renovate runs anywhere but its app installation is out of scope
  for this skill.

## Picking updater (when the user hasn't specified)

Default to **dependabot** when:
- The repo is on GitHub (which is nyann's `gh`-integration assumption).
- The user wants minimal moving parts (Dependabot is native to GH,
  no app to install).

Default to **renovate** when:
- The user mentions multi-platform forge support.
- The user wants advanced grouping / customization (Renovate's
  package rules are richer than Dependabot's `groups`).
- The user is already a Renovate user on other repos.

When in doubt, ask:
> "Dependabot is GitHub-native and zero-install — recommended for
> most. Renovate is more configurable but requires installing the
> Renovate GitHub App. Which do you want?"

## Picking ecosystems

Read the StackDescriptor (from `bin/detect-stack.sh`) and map:

| Stack hint | Ecosystem(s) |
|---|---|
| `primary_language=typescript` / `javascript` | `npm` |
| `primary_language=python` | `pip` |
| `primary_language=go` | `gomod` |
| `primary_language=rust` | `cargo` |
| `primary_language=ruby` | `bundler` |
| `primary_language=php` | `composer` |
| `primary_language=java` (Maven) | `maven` |
| `primary_language=java` (Gradle) / `kotlin` | `gradle` |
| `primary_language=dart` | `pub` |
| `primary_language=csharp` / `dotnet` | `nuget` |
| `primary_language=elixir` | `mix` (v1.10+) |
| `primary_language=swift` | `swift` |
| `Dockerfile` present | `docker` (in addition to language ecosystem) |
| `.github/workflows/` present | `github-actions` (always recommended) |

Always include `github-actions` even when the user didn't ask — it
keeps the SAST workflow pins current.

For monorepos (`workspaces` resolved by `bin/resolve-workspace-configs.sh`),
emit one `--ecosystem` per workspace with the workspace path as
`--directory`. Dependabot doesn't auto-walk; one entry per manifest
is mandatory.

## Preview, then apply

Always preview first. Even if the user said "just do it", show the
rendered config and wait for confirmation:

```
bin/gen-dependency-updater.sh --updater dependabot --ecosystem npm --ecosystem github-actions
```

Then on confirmation:

```
bin/gen-dependency-updater.sh --updater dependabot \
  --ecosystem npm --ecosystem github-actions \
  --target . --apply
```

If the destination file already exists and matches: log "unchanged"
and exit. If it differs: print diff, exit 3, prompt the user before
re-running with `--force-overwrite`.

## Output

- `.github/dependabot.yml` (Dependabot)
- `renovate.json` (Renovate, at repo root)

Both files include a comment header tagging the nyann version that
generated them, so a future operator can tell when to regenerate.

## Defaults explained

- **Schedule = weekly**: Daily is noisy for most teams; monthly lets
  CVEs sit. Weekly balances responsiveness vs. PR-fatigue.
- **Grouping = minor-patch**: Bundles minor + patch into one PR per
  ecosystem (review-friendly). Majors stay separate because they
  often need breaking-change review regardless of patch size.
- **open-prs = 5**: Enough headroom for routine churn; raise for
  high-velocity repos.
- **Labels = `dependencies`, `automated`**: `automated` lets you opt
  these out of expensive CI matrices via label filters.

Override any of these via the corresponding flags.