[afeezorobsco-cyber]

Closes #486

Summary

Dependabot alerts and Dependabot security updates are repository settings, not files, so a PR from a contributor cannot switch them on. This PR gives maintainers a documented, repeatable, and verifiable way to do it. Once merged, a maintainer with admin access runs one command (or clicks three toggles) and can confirm the result.

Current state, as seen from a non-admin account with pnpm dependabot:check:

[ENABLED]  Dependency graph — Always on for public repositories.
[DISABLED] Dependabot alerts — Requires admin access to read or change.
[DISABLED] Dependabot security updates

(GitHub returns 404 both for "off" and for "no admin access", so a maintainer needs to confirm this.)

Changes

File	What
docs/DEPENDABOT_SECURITY.md	New runbook: what each setting does, how to enable it in the UI or via the API, how to verify it, who can see alerts, how to triage security-update PRs, and how this relates to #482.
scripts/dependabot-security.mjs	New helper. It checks state by default; --apply enables alerts and then security updates through gh api. It is read-only unless --apply is passed and stops if enabling alerts fails, because GitHub rejects security updates while alerts are off. It reports paused and unknown states rather than treating them as enabled. It uses the repo's structured logger, so logging:check passes.
scripts/dependabot-security.test.mjs	13 node:test cases against a fake gh api: state parsing (204/404/403/paused/private), evaluation, apply ordering and early stop, argument validation, exit codes, and a check that check mode never sends a write request.
package.json	dependabot:check, dependabot:apply, dependabot:test
README.md	Links the runbook from the Documentation table.

Acceptance criteria

• Enable dependency graph and Dependabot alerts. The dependency graph is already locked on for this public repo, which the script verifies. Alerts are enabled with PUT /repos/{owner}/{repo}/vulnerability-alerts (pnpm dependabot:apply) or Settings → Advanced Security.
• Enable Dependabot security updates. Enabled with PUT /repos/{owner}/{repo}/automated-security-fixes, applied after alerts.
• Keep security updates targeted to vulnerable dependencies. The runbook keeps Grouped security updates off, explains that security PRs bump only the vulnerable package to the minimum patched version, and tells reviewers to close any PR that pulls in unrelated upgrades. Routine bumps stay in security(repo): enable weekly Dependabot updates for npm, Cargo, and Actions #482.
• Confirm alerts are visible only to users with appropriate permissions. The runbook has an Alert visibility section: only write/maintain/admin collaborators can see alerts, and read-only or fork contributors and the public cannot. It also lists the collaborator review to do before enabling.
• Link security(repo): enable weekly Dependabot updates for npm, Cargo, and Actions #482 as the separate scheduled-maintenance task. Linked at the top of the runbook, in Related, and here.
• No dependency upgrade. No manifests or lockfiles changed.

Maintainer action after merge ⚠️

This PR cannot flip the settings itself. With an admin account:

gh auth status            # must be an admin of Sub-Rosa-Issue/sub-rosa-issue
pnpm dependabot:apply     # enables alerts, then security updates, then prints state
pnpm dependabot:check     # expect three [ENABLED] lines and exit code 0

Or use the UI: Settings → Advanced Security → Dependabot alerts: Enable → Dependabot security updates: Enable.

Testing

pnpm dependabot:test           # 13 passed, 0 failed
node scripts/check-links.js    # OK 44 local link(s) checked
node scripts/check-logging.mjs # No direct console calls
node scripts/dependabot-security.mjs   # live read-only check against upstream (output above)

Related

• security(high/easy): enable Dependabot alerts and security updates #486 (this issue)
• security(repo): enable weekly Dependabot updates for npm, Cargo, and Actions #482: scheduled weekly Dependabot version updates (.github/dependabot.yml), kept separate on purpose

🤖 Generated with Claude Code

[drips-wave]

@afeezorobsco-cyber Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits