feat(scripts): add python dependabot pruner to fix-dependabot.sh

[hyperpolymath]

This PR adds a python script to prune invalid ecosystems from dependabot.yml when running fix-dependabot.sh, addressing Type 1/2 validation errors across the estate.

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 5 resolved / 5 findings

Adds a python dependabot pruner script to fix-dependabot.sh, but the implementation incorrectly renames guix.scm files, ignores subdirectories and multiple ecosystems, and strips yaml formatting.

✅ 5 resolved

✅ Bug: Pruner ignores directory/directories; wrongly prunes valid entries

📄 scripts/prune-dependabot.py:33-47 📄 scripts/fix-dependabot.sh:20-26
has_manifest() only checks the repo root (e.g. os.path.join(repo, 'Cargo.toml')), but dependabot update entries carry a directory: or directories: field pointing manifests at subdirectories. This repo's own .github/dependabot.yml has a cargo entry whose directories: list is /robot-repo-automaton, /shared-context, /bots/* — none at the root. Running the pruner will delete these valid entries because no root Cargo.toml matches, silently breaking dependency updates. Resolve the per-update directory list and check each specified path for the manifest instead of the repo root.

✅ Bug: Unknown ecosystems silently pruned (docker, terraform, etc.)

📄 scripts/prune-dependabot.py:33-47 📄 scripts/prune-dependabot.py:56
has_manifest() returns False for any ecosystem not in its hardcoded list — docker, gitsubmodule, terraform, composer, nuget, gradle, maven, devcontainers, etc. These are all valid dependabot ecosystems, but the pruner will remove them, breaking working configs. Default unknown ecosystems to kept (return True) rather than pruned, so the tool only removes entries it can positively prove are invalid.

✅ Quality: yaml.dump rewrites file, stripping comments and formatting

📄 scripts/prune-dependabot.py:62-66
When changes occur, yaml.safe_load + yaml.dump rewrites the whole dependabot.yml, discarding comments (e.g. the SPDX header the sibling generator emits), quoting style, and original ordering. This produces noisy, hard-to-review diffs on estate-wide runs. Consider using ruamel.yaml for round-trip preservation, or only rewriting when an entry is actually removed and warning that formatting will change.

✅ Edge Case: pip detection misses pyproject.toml and Pipfile

📄 scripts/prune-dependabot.py:42-43 📄 scripts/fix-dependabot.sh:47-49
The pip check only looks for requirements.txt or setup.py, but modern Python projects commonly declare dependencies via pyproject.toml or Pipfile. A valid pip entry in a Poetry/PEP-621/Pipenv project would be pruned. Add pyproject.toml and Pipfile to the pip manifest set (the fix-dependabot.sh detection at lines 47-48 has the same gap).

✅ Quality: guix.scm files renamed to 'squisher-corpus', destroying echidnabot package

📄 bots/echidnabot/guix.scm:1-15 📄 guix.scm:9-17
bots/echidnabot/guix.scm had its full cargo package definition (inputs, native-inputs, synopsis, build-system) replaced with a stub named "squisher-corpus", and the top-level guix.scm was also renamed from "gitbot-fleet" to "squisher-corpus". If this templating overwrite is unintended, guix build/guix shell for echidnabot will no longer build the actual bot, and the fleet package now advertises the wrong project name/home-page. Confirm these chore-commit overwrites are intentional and not cross-repo contamination from squisher-corpus.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}