Assess Current Estate Split and Standardisation Impact

🧑‍💼 User Need

As a member of the DevX team
I want to understand the current split between Dependabot and Renovate usage across the estate
so that we can assess the impact of standardising on one tool and prioritise remediation accordingly

💡 Value / Purpose

• Understanding the current state is essential before recommending a change of dependency-management tooling
• Evidence-based impact assessment prevents a well-intentioned decision from creating disproportionate disruption.

🛠️ Description / Context

• Verify whether the GitHub Actions workflow posture analysis or list_repos already captures anything relating to Dependabot vs Renovate. If so, use this data as a starting point. If not, extend the audit scripts (list_repos or github_workflows) to identify:

  • Repos with .github/dependabot.yml configured
  • Repos with renovate.json configured
  • Repos with both configured
  • Repos with neither configured

• For each scenario, document the count and percentage across the top 400 repos, and extrapolate to the full estate where possible

• Assess the impact of standardising on the agreed tool - how many would require migration, what effort is involved, and if migration could be automated in any capacity.

🧪 Testing steps

• Verify data against a sample of known repos manually
• Confirm counts are consistent with existing workflow posture findings where applicable.

✅ Definition of Done

• Current Dependabot vs Renovate split dopcumented across the top 400 repos
• Repos with both or neither configured identified
• Impact of standardisation assessed, including migration effort estimate
• Automation feasibility for migration noted
• Findings shared with wider team where applicable

Start by reviewing the existing workflow posture analysis and the list_repos and github_workflows audit scripts to see what Dependabot or Renovate data they already capture. Extend the relevant audit output to classify the top 400 repositories, then manually verify a sample and compare results with existing workflow findings. Done means the four configuration counts and percentages, estate extrapolation, standardisation impact, migration effort, and automation feasibility are documented.