From 408ff77dc542e3d5c088ee80377e57d0b2076243 Mon Sep 17 00:00:00 2001
From: River Lynn Bailey <river.bailey@testdouble.com>
Date: Tue, 14 Jul 2026 09:35:27 -0600
Subject: [PATCH] fix(CI): add required patterns key to Dependabot ecosystem
 entries

Dependabot rejected the whole config with:

  The property '#/updates/0/patterns' is required when 'multi-ecosystem-group'
  is set.

An updates entry that joins a multi-ecosystem group must declare which
dependencies it takes in; GitHub documents `["*"]` as the way to include all
of them. All three entries (npm, github-actions, pre-commit) set the group but
omitted patterns, so none of them validated and no update PRs could open.

Add `patterns: ["*"]` to each entry, preserving the existing group and
cooldown settings.
---
 .github/dependabot.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a4344a75..6defd51a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,10 @@ version: 2
 # supply-chain risk from fresh or compromised releases. Cooldown does not apply
 # to security updates, so enabling Dependabot security updates in the repository
 # settings still lands those immediately.
+#
+# Every ecosystem below sets `patterns: ["*"]` to take in all of its
+# dependencies. Dependabot requires `patterns` on each entry that joins a
+# multi-ecosystem group, and rejects the whole file without it.
 multi-ecosystem-groups:
   dev-tooling:
     schedule:
@@ -15,6 +19,7 @@ updates:
   # npm devDependencies: prek, Prettier, Bats.
   - package-ecosystem: npm
     directory: "/"
+    patterns: ["*"]
     multi-ecosystem-group: dev-tooling
     cooldown:
       default-days: 30
@@ -22,6 +27,7 @@ updates:
   # GitHub Actions used by the CI workflows.
   - package-ecosystem: github-actions
     directory: "/"
+    patterns: ["*"]
     multi-ecosystem-group: dev-tooling
     cooldown:
       default-days: 30
@@ -30,6 +36,7 @@ updates:
   # pre-commit-hooks). prek reads the same config format Dependabot updates.
   - package-ecosystem: pre-commit
     directory: "/"
+    patterns: ["*"]
     multi-ecosystem-group: dev-tooling
     cooldown:
       default-days: 30