The managed source at Repos/Module/dependabot.yml/.github/dependabot.yml configures:
- package-ecosystem: "powershell"
directory: "/"
schedule:
interval: "weekly"
labels:
- "dependencies"
- "powershell"Dependabot has no powershell package ecosystem. The valid values are enumerated in PACKAGE_MANAGER_LOOKUP in common/lib/dependabot/config/file.rb and listed in the Dependabot options reference; neither contains powershell.
Why it matters
An unsupported package-ecosystem value makes .github/dependabot.yml invalid, which puts the whole file's coverage at risk — including the github-actions entry above it that does work. Any repository that received this managed file would end up with worse supply-chain coverage than one with no Dependabot config at all.
Current blast radius: none
No repository in the organization has adopted it. gh search code --owner PSModule 'package-ecosystem powershell' returns nothing, and .github/dependabot.yml in Template-PSModule, Domeneshop, Base64, Jwt, Toml, Sodium, Context, GitHub, and Lovdata all use github-actions only (Sodium additionally uses nuget, which is valid). So this is a latent defect in the managed source, not a live incident.
Desired outcome
The managed file should match what Template-PSModule actually ships:
version: 2
updates:
- package-ecosystem: github-actions
directory: /
labels:
- dependencies
- github-actions
schedule:
interval: daily
cooldown:
default-days: 7The powershell entry should be removed rather than kept as a placeholder for a future capability.
Distribution is moving to MSXOrg/Custo, so the main point of this issue is that the defect must not be carried across during that migration. Fix it here or drop it during the port — but do not port it as-is.
References
The managed source at
Repos/Module/dependabot.yml/.github/dependabot.ymlconfigures:Dependabot has no
powershellpackage ecosystem. The valid values are enumerated inPACKAGE_MANAGER_LOOKUPincommon/lib/dependabot/config/file.rband listed in the Dependabot options reference; neither containspowershell.Why it matters
An unsupported
package-ecosystemvalue makes.github/dependabot.ymlinvalid, which puts the whole file's coverage at risk — including thegithub-actionsentry above it that does work. Any repository that received this managed file would end up with worse supply-chain coverage than one with no Dependabot config at all.Current blast radius: none
No repository in the organization has adopted it.
gh search code --owner PSModule 'package-ecosystem powershell'returns nothing, and.github/dependabot.ymlinTemplate-PSModule,Domeneshop,Base64,Jwt,Toml,Sodium,Context,GitHub, andLovdataall usegithub-actionsonly (Sodiumadditionally usesnuget, which is valid). So this is a latent defect in the managed source, not a live incident.Desired outcome
The managed file should match what
Template-PSModuleactually ships:The
powershellentry should be removed rather than kept as a placeholder for a future capability.Distribution is moving to
MSXOrg/Custo, so the main point of this issue is that the defect must not be carried across during that migration. Fix it here or drop it during the port — but do not port it as-is.References