As Greenkeeper is phasing out and migrating its users to Snyk, we decided to migrate to Dependabot, which has been acquired by GitHub about a year ago and is increasingly becoming a built-in GitHub feature.

There are some trade-offs unfortunately:

• Dependabot has been created with a focus on apps, not libraries. By default, Dependabot sends updates for all dependency updates, including updates that are within the range of what's defined in package.json's "dependencies" and "devDependencies". This is causing a lot of noise. Luckily, the new v2 configuration option versioning-strategy: "increase-if-necessary" makes Depedendabot send pull requests for out-of-range updates only
• One of my favorite features of Greenkeeper is live monitoring of in-range dependency updates. It creates a branch, which triggers the CI but does not create any notifications. If CI passes, the branch is deleted again. But if it fails, Greenkeeper creates an issues, so the maintainers can pin the version of the affected dependency, in order to prevent sudden breaking changes for its dependands. See https://greenkeeper.io/docs.html#greenkeeper-step-by-step

I've talked to @feelepxyz who kindly enabled the v2 configuration on @octokit. I will add the following configuration to all Octokit JS-related repositories:

version: 2
updates:
  # create PRs for out-of-range updates
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
    versioning-strategy: "increase-if-necessary"

Todos:

1. Uninstall Greenkeeper app
2. Update in this repository
   • Add badge to repository
   • Add .github/dependabot.yml configuration
   • lib/create-readme.js
   • .github/workflows/test.yml
   • lib/create-test-action.js
   • create-octokit-project.js
3. Update all other repositories in @octokit

• Check if README.md includes Greenkeeper badge. If it doesn't, ignore repository
• Create pull request

  • set "maintenance" label

  • Remove Greenkeeper badge

  • .github/workflows/update-prettier.yml files:

    -- "greenkeeper/prettier-*"
    +- "dependabot/npm_and_yarn/prettier-*"

  • .github/workflows/test.yml files:

    -- "greenkeeper/**"

  • Create .github/dependabot.yml with the configuration above