compile rewrites dependabot.yml: strips comments and reorders keys (not prettier-compliant)

[heiskr]

🤖 Filed by Copilot on behalf of @heiskr (docs-engineering).

Summary

Running gh aw compile on a workflow rewrites the repo's .github/dependabot.yml as a side effect. The rewrite drops all existing comments and reorders keys into a shape that is not prettier-compliant (block sequences written with no indent under their key, keys alphabetized rather than kept in logical order). The functional config is preserved, but the diff is noisy and destroys human-authored documentation in the file.

Reformatting the file is fine in principle. The two problems are:

1. Existing comments are stripped. They often explain non-obvious config, for example why a dependency is ignored, so losing them is real information loss.
2. Output is not prettier-compliant. It does not match what prettier produces for the same YAML, so it conflicts with repos that run prettier and creates churn on every compile.

Reproduce

1. In a repo with a commented .github/dependabot.yml and a gh-aw workflow, run gh aw compile <workflow>.md.
2. git status shows .github/dependabot.yml modified even though only the workflow was compiled.

Version: gh aw extension github/gh-aw v0.79.1.

Example diff

From a real compile in github/docs-team, where the file started with a documented, prettier-formatted config:

-# This file should help us to maintain our GitHub Actions and npm dependencies at the latest versions.
-#
-# To update this file, see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-
-# Adding maintenance updates for GitHub Actions now we use them
-# to deploy the onboarding content to a GitHub Pages site
 updates:
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    schedule:
-      interval: weekly
-      day: monday
+- cooldown:
+    default-days: 7
+  directory: /
+  groups:
+    actions:
+      patterns:
+      - "*"
+  ...
+  package-ecosystem: github-actions
+  schedule:
+    day: monday
+    interval: weekly
+version: 2

All four leading comment blocks and the inline comments were removed, and keys were alphabetized.

Suggested fix

When the compiler touches dependabot.yml:

• Preserve existing comments, using a comment-preserving YAML round-trip rather than marshal then unmarshal.
• Emit prettier-compliant formatting (2-space indented block sequences, preserved key order where possible), or leave the file untouched when the only change would be cosmetic.

Context

Surfaced while adding an agent in github/docs-team#6913. We currently restore dependabot.yml by hand after each compile to keep it out of unrelated PRs.

[pelikhan]

@copilot

• compile should only touch dependabot if --dependabot flag is used on the command.
• avoid marshalling the YAML and patch it instead if possible.