🤖 Automating Dependabot at Scale: GitHub Actions Strategy

┌──────────────────────────────────────────────────────────────────────────┐
│                         GitHub Organization                              │
├──────────────────────────────┬───────────────────────────────────────────┤
│  Inactivity Report           │  Keep-Alive (Scheduled)                   │
│  (Daily Monitor)             │  (Quarterly Maintenance)                  │
│                              │                                           │
│  • Scans all repos           │  • Nudges open PRs                        │
│  • Detects ≥75d inactivity   │  • Creates reminder issues                │
│  • Reports to central repo   │  • Prevents 90d pause                     │
│  • Early warning system      │  • Distributed intervention               │
└──────────────────────────────┴───────────────────────────────────────────┘

# Uses GitHub Search API to find Dependabot-enabled repos
search_query="org:${ORG}+path:.github+filename:dependabot.yml"

cutoff-days: 75  # Alert 15 days before the 90-day pause

repo-includes: 'frontend-*,backend-*'  # Include specific patterns
repo-excludes: '*-archive,*-deprecated'  # Exclude patterns

name: Dependabot Inactivity Report

on:
  schedule:
    - cron: "0 1 * * *"
  workflow_dispatch:
    inputs:
      org:
        description: 'Organization name'
        required: false
        default: 'your-org'
      runner:
        description: 'JSON array of runner labels'
        required: false
        default: '["ubuntu-latest"]'
      dry-run:
        description: 'If true, only writes a job summary (no issue).'
        required: false
        type: boolean
        default: true
      cutoff-days:
        description: 'Cutoff days for inactivity'
        required: false
        type: number
        default: 75
      team-handle:
        description: 'team handle to mention in the issue'
        required: false
        default: '@your-org/maintainers'
      repo-includes:
        description: 'Comma-separated list of repo name patterns to include (supports wildcards)'
        required: false
        default: ''
      repo-excludes:
        description: 'Comma-separated list of repo name patterns to exclude (supports wildcards)'
        required: false
        default: ''

permissions:
  contents: read
  issues: write

env:
  ORG: ${{ github.event_name == 'workflow_dispatch' && inputs.org || 'your-org' }}
  TEAM_HANDLE: ${{ github.event_name == 'workflow_dispatch' && inputs['team-handle'] || '@your-org/maintainers' }}
  CUTOFF_DAYS: ${{ github.event_name == 'workflow_dispatch' && inputs['cutoff-days'] || 75 }}
  REPO_INCLUDES: ${{ github.event_name == 'workflow_dispatch' && inputs['repo-includes'] || '' }}
  REPO_EXCLUDES: ${{ github.event_name == 'workflow_dispatch' && inputs['repo-excludes'] || '' }}

jobs:
  scan:
    strategy:
      matrix:
        runner: ${{ fromJSON(github.event_name == 'workflow_dispatch' && inputs.runner || '["ubuntu-latest"]') }}
    runs-on: ${{ matrix.runner }}
    env:
      GH_TOKEN: ${{ secrets.ORG_READ_TOKEN }}
    steps:
      - name: Scan org repos for inactivity
        id: scan
        shell: bash
        run: |
          set -euo pipefail

          echo "🔍 Scanning organization: $ORG (Dependabot-enabled repos only)"
          echo "⏰ Cutoff days: $CUTOFF_DAYS"
          if [[ -n "$REPO_INCLUDES" ]]; then
            echo "✅ Including repos matching: $REPO_INCLUDES"
          fi
          if [[ -n "$REPO_EXCLUDES" ]]; then
            echo "❌ Excluding repos matching: $REPO_EXCLUDES"
          fi

          # Helper functions
          matches_pattern() {
            local repo="$1" patterns="$2"
            [[ -z "$patterns" ]] && return 0
            IFS=',' read -ra PATTERN_ARRAY <<< "$patterns"
            for pattern in "${PATTERN_ARRAY[@]}"; do
              pattern=$(echo "$pattern" | xargs)
              [[ -z "$pattern" ]] && continue
              [[ "$repo" == $pattern ]] && return 0
            done
            return 1
          }

          should_include_repo() {
            local repo="$1"
            if [[ -n "$REPO_INCLUDES" ]] && ! matches_pattern "$repo" "$REPO_INCLUDES"; then
              return 1
            fi
            if [[ -n "$REPO_EXCLUDES" ]] && matches_pattern "$repo" "$REPO_EXCLUDES"; then
              return 1
            fi
            return 0
          }

          # Find repos with Dependabot using GitHub Search API
          search_query="org:${ORG}+path:.github+filename:dependabot.yml"
          repos_with_dependabot="$(gh api "search/code?q=${search_query}" --jq '.items[].repository.full_name' | sort -u || true)"
          
          if [[ -z "$repos_with_dependabot" ]]; then
            echo "⚠️ No repositories found with Dependabot configuration"
            exit 0
          fi

          repos="$(echo "$repos_with_dependabot" | sed "s|^${ORG}/||")"
          repo_count=$(echo "$repos" | grep -c . || echo "0")
          echo "📊 Found $repo_count repositories with Dependabot"

          now="$(date -u +%s)"
          cutoff=$(( CUTOFF_DAYS * 86400 ))
          warn_list=""

          while IFS= read -r repo; do
            [[ -z "$repo" ]] && continue
            should_include_repo "$repo" || { echo "⏭️ Skipping $repo (filtered)"; continue; }
            
            full="$ORG/$repo"
            
            # Get last Dependabot PR activity
            last_pr_update="$(gh pr list -R "$full" --author dependabot[bot] --state all --json updatedAt -q '.[].updatedAt' || true)"
            
            # Get latest "Dependabot Updates" workflow run
            wf_runs="$(gh api -q '.workflow_runs[]?|select(.name=="Dependabot Updates")|.updated_at' "/repos/$full/actions/runs?per_page=100" 2>/dev/null || true)"
            
            latest="$(printf "%s\n%s\n" "$last_pr_update" "$wf_runs" | grep -E '.+' | sort -r | head -n1 || true)"
            
            if [[ -z "$latest" ]]; then
              warn_list+="$full - no Dependabot activity found"$'\n'
              continue
            fi
            
            latest_s="$(date -u -d "$latest" +%s 2>/dev/null || echo 0)"
            age=$(( now - latest_s ))
            
            if [[ "$latest_s" -eq 0 || "$age" -ge "$cutoff" ]]; then
              days=$(( age / 86400 ))
              warn_list+="$full - last activity: $latest (${days}d ago)"$'\n'
            fi
          done <<< "$repos"

          {
            echo "warn_list<<EOF"
            printf "%s" "$warn_list"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Dry-run - job summary
        if: ${{ github.event_name == 'workflow_dispatch' && inputs['dry-run'] == true }}
        shell: bash
        run: |
          {
            printf "### Dependabot inactivity report (≥%s days) — %s\n\n" "$CUTOFF_DAYS" "$TEAM_HANDLE"
            if [ -z "${{ steps.scan.outputs.warn_list }}" ]; then
              echo "No repos nearing the threshold 🎉"
            else
              echo "The following repos may pause soon:"
              echo '```'
              printf "%s\n" "${{ steps.scan.outputs.warn_list }}"
              echo '```'
            fi
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Post issue (real mode)
        if: ${{ github.event_name != 'workflow_dispatch' || inputs['dry-run'] != true }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          if [ -n "${{ steps.scan.outputs.warn_list }}" ]; then
            title="Dependabot inactivity report (≥${CUTOFF_DAYS} days) — ${TEAM_HANDLE}"
            body="${TEAM_HANDLE}

          The following repositories are nearing the ${CUTOFF_DAYS}-day Dependabot pause threshold:

          ${{ steps.scan.outputs.warn_list }}"

            existing="$(gh issue list -R "$GITHUB_REPOSITORY" --search "$title in:title" --json number,title -q '.[] | select(.title=="'"$title"'") | .number' | head -n1 || true)"

            if [ -n "${existing:-}" ]; then
              gh issue comment -R "$GITHUB_REPOSITORY" "$existing" --body "$body"
            else
              gh issue create -R "$GITHUB_REPOSITORY" --title "$title" --body "$body" --label "dependencies"
            fi
          fi

gh pr comment -R "$repo" "$pr_number" --body "@dependabot rebase"

@your-team

No open Dependabot PRs found in org/repo.

Action: Press **Insights → Dependency graph → Dependabot → 
Recent update jobs → Check for updates** in the UI.

# Searches for existing issues created by GitHub Actions
existing="$(gh issue list -R "$repo" \
  --search "Dependabot keep-alive in:title is:open author:app/github-actions" \
  --json number -q '.[0].number')"

# Check if 'dependencies' label exists before using it
if gh api repos/$repo/labels/dependencies --silent >/dev/null 2>&1; then
  # Create with label
else
  # Create without label (no failure)
fi

# ❌ Causes script failure
((total_issues++))

# ✅ Works correctly
total_issues=$((total_issues + 1))

GH_TOKEN: ${{ inputs.scan-mode == 'org' && secrets.ORG_READ_TOKEN || secrets.GITHUB_TOKEN }}

name: Dependabot Keep-Alive (Scheduled)

on:
  schedule:
    - cron: "0 0 1 */3 *"
  workflow_dispatch:
    inputs:
      mode:
        description: 'runner mode: hosted or selfhosted'
        required: false
        default: 'hosted'
        
# Critical for org-wide operations
permissions:
  contents: read
  pull-requests: write
  issues: write
  # Note: For org-wide scanning, ensure ORG_READ_TOKEN secret has:
  # - repo (full control of repositories)
  # - workflow (update GitHub Action workflows)
  # - read:org (read org and team membership, read org projects)

jobs:
  call:
    uses: ./.github/workflows/dependabot-keep-alive.yml
    secrets: inherit
    with:
      runs-on: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'selfhosted'
        && '["self-hosted","dependabot"]' || '["ubuntu-latest"]'  }}
      team-handle: "@your-org/maintainers"
      scan-mode: 'org'  # Use organization mode to scan all repos with dependabot
      org: 'your-org'   # Specify the organization to scan

# Keep-alive for production services only
repo-includes: 'prod-*,service-*'
repo-excludes: '*-test,*-sandbox'

- name: Notify team
  uses: slackapi/slack-github-action@v1
  with:
    payload: |
      {
        "text": "Dependabot inactivity alert",
        "blocks": [...]
      }