Dep-bump setup never lands dependabot.yml (missing PR wiring) #33

Summary

The dep-bump setup produces a .github/dependabot.yml on a local chore/add-dependabot-config branch but never commits, pushes, or opens a PR for it. On the scanner host, both agent-skills and automation clones were left with an uncommitted dependabot.yml and an empty (zero-commits-ahead) chore/add-dependabot-config branch that was never pushed. As a result, dependabot is not actually enabled on either repo.

Evidence

On kagenti-bot, for both ~/kagenti/agent-skills and ~/kagenti/automation:

• .github/dependabot.yml present in the working tree (agent-skills: staged; automation: untracked), identical content in both.
• Local branch chore/add-dependabot-config exists, never pushed to any remote.
• The file is not committed on that branch (branch is 0 commits ahead of origin/main).
• The file is not on origin/main in either repo, and no PR was ever opened.

The uncommitted files + empty branches have since been cleaned off the host clones; this issue preserves the intended config and the wiring gap.

Root cause

The dep-bump skill flow (dep-bump-scanner / dep-bump-fixer) creates the config file and a branch but stops before the git add + commit + push + gh pr create steps. This is missing wiring in the skill instructions, not intentional WIP.

The config that should be landed

Both repos should get this .github/dependabot.yml via a proper PR:

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      minor-and-patch:
        update-types:
          - "minor"
          - "patch"

Proposed fix

1. Open chore: PRs adding .github/dependabot.yml to rossoctl/agent-skills and rossoctl/automation.
2. Fix the dep-bump skill wiring so config-generating runs carry through commit → push → PR (or clearly hand off to a PR step), rather than leaving uncommitted files on the host.

Assisted-By: Claude Code