[JanaME]

Dependabot can't extend a shared config, so the repositories had drifted to 16 different dependabot.yml files for 25 repositories. Only one of them grouped npm updates. That's why wp-postqueue has eight @wordpress/* pull requests open, and merging one puts the other seven in conflict.

What changes

• dependabot/bin/generate.sh writes a repository's .github/dependabot.yml from one template (docs/dependabot.md):
  • an entry per ecosystem found: npm per package-lock.json directory, composer per composer.json that requires a package, github-actions always
  • weekly; a 7-day cooldown except for @palasthotel/* / palasthotel/*, as in the Renovate preset. Security updates still come right away: Dependabot applies no cooldown to them.
  • groups: all @wordpress/* in one pull request, majors included; everything else minor/patch in one; security updates in one. Majors outside @wordpress come alone.
  • github-actions always with directory: "/". Eleven repositories have /.github/, which makes Dependabot look for a composite action and never check the workflows.
• wp-plugin-pr.yml gets a job that warns (doesn't fail) when the file differs from the template.
• This repository's own dependabot.yml is generated, too.

Verified

• tests/dependabot.sh (12 cases), shellcheck, actionlint.
• Generated for wp-postqueue, headless (two npm directories), blockX, firebase-notifications, grid, prolitteris, emoji-guard, media-license and cron-logger. The ecosystems and directories are as expected, and the output is valid against the SchemaStore Dependabot schema.