Migrating from Dependabot

This guide provides detailed instructions for migrating from GitHub's Dependabot to Buddy, including configuration conversion and enhanced features.

Automated Migration

Buddy can automatically detect and migrate Dependabot configurations:

buddy setup

The migration process will:

• 🔍 Detect .github/dependabot.yml or .github/dependabot.yaml
• ⚙️ Convert basic settings to Buddy format
• ⚠️ Identify configuration gaps (Dependabot is limited)
• 📋 Suggest enhancements and optimizations

Configuration Mapping

Basic Settings

Schedule Conversion

Dependabot Intervals → Cron:

With Time and Timezone:

# Dependabot
schedule:
  interval: "weekly"
  day: "monday"
  time: "04:00"
  timezone: "America/New*York"

// Buddy
{
  schedule: {
    cron: '0 4 * * 1', // Monday 4 AM
    timezone: 'America/New*York'
  }
}

Migration Examples

Simple npm Configuration

Before (Dependabot):

version: 2
updates:

  - package-ecosystem: "npm"

    directory: "/"
    schedule:
      interval: "weekly"
    ignore:

      - dependency-name: "react"
      - dependency-name: "typescript"

After (Buddy):

export default {
  schedule: {
    cron: '0 2 * * 1', // Weekly Monday 2 AM
    timezone: 'UTC'
  },
  packages: {
    strategy: 'all',
    ignore: ['react', 'typescript']
  }
} satisfies BuddyConfig

Multi-Ecosystem Configuration

Before (Dependabot):

version: 2
updates:

  - package-ecosystem: "npm"

    directory: "/"
    schedule:
      interval: "daily"
    assignees:

      - "frontend-team"

    labels:

      - "npm"
      - "dependencies"

  - package-ecosystem: "composer"

    directory: "/"
    schedule:
      interval: "weekly"
    assignees:

      - "backend-team"

    labels:

      - "composer"
      - "dependencies"

  - package-ecosystem: "github-actions"

    directory: "/"
    schedule:
      interval: "monthly"
    assignees:

      - "devops-team"

    labels:

      - "github-actions"
      - "dependencies"

After (Buddy):

export default {
  schedule: {
    cron: '0 2 * * *', // Daily base schedule
    timezone: 'UTC'
  },
  packages: {
    strategy: 'all',
    rules: [
      {
        matchEcosystems: ['npm'],
        groupName: 'npm packages',
        assignees: ['frontend-team'],
        labels: ['npm', 'dependencies']
      },
      {
        matchEcosystems: ['composer'],
        groupName: 'Composer packages',
        schedule: '0 2 * * 1', // Only proposed on a Monday run
        assignees: ['backend-team'],
        labels: ['composer', 'dependencies']
      },
      {
        matchEcosystems: ['github-actions'],
        groupName: 'GitHub Actions',
        schedule: '0 2 1 * *', // Only proposed on a first-of-month run
        assignees: ['devops-team'],
        labels: ['github-actions', 'dependencies']
      }
    ]
  }
} satisfies BuddyConfig

Advanced Configuration with Ignores

Before (Dependabot):

version: 2
updates:

  - package-ecosystem: "npm"

    directory: "/"
    schedule:
      interval: "daily"
      time: "06:00"
      timezone: "Europe/London"
    ignore:

      - dependency-name: "react"

        versions: [">=17.0.0"]

      - dependency-name: "@types/*"
      - dependency-name: "eslint"

        update-types: ["version-update:semver-major"]
    assignees:

      - "maintainer"

    reviewers:

      - "security-team"

    labels:

      - "dependencies"
      - "automerge"

After (Buddy):

export default {
  schedule: {
    cron: '0 6 * * *', // Daily 6 AM
    timezone: 'Europe/London'
  },
  packages: {
    strategy: 'minor', // Excludes major updates globally
    ignore: [
      'react', // Ignore react entirely
      '@types/*', // Ignore all @types packages
    ],
    rules: [
      {
        matchPackages: ['eslint'],
        groupName: 'ESLint Updates',
        strategy: 'minor', // Only minor/patch for eslint
        autoMerge: false
      },
      {
        matchUpdateTypes: ['patch'],
        groupName: 'Auto-merge Updates',
        autoMerge: true,
        labels: ['dependencies', 'automerge']
      }
    ]
  },
  pullRequest: {
    assignees: ['maintainer'],
    reviewers: ['security-team'],
    labels: ['dependencies']
  }
} satisfies BuddyConfig

Enhanced Features

Buddy provides several features not available in Dependabot:

Dependency Dashboard

export default {
  dashboard: {
    enabled: true,
    title: 'Dependency Dashboard',
    pin: true,
    includePackageJson: true,
    includeGitHubActions: true,
    labels: ['dependencies', 'dashboard']
  }
} satisfies BuddyConfig

Smart Grouping

export default {
  packages: {
    rules: [
      {
        matchPackages: ['react', 'react-*', '@types/react*'],
        groupName: 'React Ecosystem',
        strategy: 'minor'
      },
      {
        matchPackages: ['@types/*'],
        groupName: 'TypeScript Definitions',
        autoMerge: true
      },
      {
        matchPackages: ['eslint*', 'prettier', '@typescript-eslint/*'],
        groupName: 'Development Tools',
        strategy: 'minor',
        schedule: '0 2 * * 1' // Only proposed on a Monday run
      }
    ]
  }
} satisfies BuddyConfig

Auto-merge Configuration

export default {
  pullRequest: {
    autoMerge: {
      enabled: true,
      strategy: 'squash',
      conditions: ['patch-only'],
      requireGreenCI: true
    }
  },
  packages: {
    rules: [
      {
        matchUpdateTypes: ['patch'],
        groupName: 'Safe Updates',
        autoMerge: true
      },
      {
        matchUpdateTypes: ['major'],
        groupName: 'Manual Review',
        autoMerge: false
      }
    ]
  }
} satisfies BuddyConfig

Migration Process

1. Backup Dependabot Configuration

cp .github/dependabot.yml .github/dependabot.yml.backup

2. Disable Dependabot

Add this to your Dependabot config to disable it temporarily:

version: 2
updates: []
# Temporarily disabled for Buddy migration

3. Run Buddy Setup

buddy setup

4. Test Configuration

# Scan for updates
buddy scan --verbose

# Test update process
buddy update --dry-run

# Create dashboard
buddy dashboard

5. Validate Workflows

Check generated GitHub Actions:

• .github/workflows/buddy-dashboard.yml
• .github/workflows/buddy-check.yml
• .github/workflows/buddy-update.yml

6. Monitor and Adjust

1. Week 1: Monitor PR creation and quality
2. Week 2: Fine-tune grouping and scheduling
3. Week 3: Enable auto-merge for trusted updates
4. Week 4: Remove Dependabot configuration

Comparison: Dependabot vs Buddy

Advantages of Migration

✅ Better Features

• Rich Dashboard: Visual dependency overview
• Smart Grouping: Advanced pattern-based grouping
• Flexible Scheduling: Full cron expression support
• Auto-rebase: Automatic PR updates
• Workflow Integration: Native GitHub Actions

✅ Better Control

• Granular Configuration: Per-group settings
• Conditional Auto-merge: Rule-based merging
• Custom Templates: PR title/body customization
• Advanced Filtering: Complex ignore patterns

✅ Better Visibility

• Centralized Dashboard: All dependencies in one place
• Update Analytics: Track update patterns
• PR Management: Enhanced PR lifecycle
• Status Tracking: Real-time update status

Troubleshooting

Common Issues

Limited ecosystem support:

Buddy focuses on the most common package managers.
For other ecosystems, consider keeping Dependabot for those specific paths.

Complex ignore patterns:

# Dependabot supports complex ignore patterns
# Simplify to basic package names in Buddy

Version-specific ignores:

Buddy uses package-level ignores rather than version-specific.
Use pinning for version-specific control.

Hybrid Approach

You can run both tools for different ecosystems:

# .github/dependabot.yml (for unsupported ecosystems)
version: 2
updates:

  - package-ecosystem: "docker"

    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "terraform"

    directory: "/infrastructure"
    schedule:
      interval: "weekly"

// buddy.config.ts (for supported ecosystems)
export default {
  packages: {
    strategy: 'all'
    // npm, composer, github-actions handled here
  }
} satisfies BuddyConfig

Best Practices

✅ Do

• Start with automated migration
• Test thoroughly with dry runs
• Use dashboard for visibility
• Leverage smart grouping
• Configure auto-merge gradually

❌ Don't

• Remove Dependabot immediately
• Over-complicate initial setup
• Ignore migration warnings
• Skip workflow validation
• Forget to monitor first weeks

The migration from Dependabot to Buddy offers enhanced features and better control, while maintaining the reliability you expect from automated dependency updates.