How to Configure Dependabot Consistently Across Repos

Dependabot reads a per-repo dependabot.yml with no shared-preset mechanism, so consistency across repos means templating and syncing that file.

Keep a canonical dependabot.yml in a template repo and sync it into every repo (via a bot PR job). Each repo still needs the file locally because Dependabot has no extends.

Steps

• Author a canonical .github/dependabot.yml.
• Sync it into each repo through a bot PR (see the file-sync guide).
• Set the same schedule and grouping in every copy.

Canonical dependabot.yml

version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule:
      interval: weekly
    groups:
      internal:
        patterns:
          - "@my-org/*"

Gotchas

• Dependabot has no shared config, so a change means re-syncing the file to every repo.
• For a true single source of policy across repos, Renovate presets are the closer fit.

Related guides