require-dependabot-updates
Rule catalog ID: R071
Targeted pattern scopeโ
Repository Dependabot configuration files at .github/dependabot.yml or .github/dependabot.yaml.
What this rule reportsโ
This rule reports files that omit the top-level updates key or define it as an empty sequence.
Why this rule existsโ
updates is the section where Dependabot is told which ecosystems to maintain. Without at least one update entry, the configuration is syntactically present but operationally useless.
โ Incorrectโ
version: 2
version: 2
updates: []
โ Correctโ
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
Additional examplesโ
On repositories with multiple ecosystems, this rule helps ensure Dependabot stays enabled even after refactors remove one update block and forget to add its replacement.
ESLint flat config exampleโ
import githubActions from "eslint-plugin-github-actions-2";
export default [githubActions.configs.dependabot];
When not to use itโ
Disable this rule only when .github/dependabot.yml is intentionally not used in the repository.