Add pip and golang dependency manifest generation support

[Copilot]

Add Dependabot Manifest Generation for Python (pip) and Golang

Goal: Extend the existing dependabot manifest generation to support Python (pip) and Golang package ecosystems, similar to the existing npm support.

Status

• ✅ All builds passing
• ✅ All tests passing
• ✅ Lint and format clean
• ✅ Merging logic verified for all ecosystems

Changes

Fixed build errors (commit 578e95e+):

• Resolved syntax error in generateDependabotConfig from merge conflict
• Removed duplicate code that referenced undefined npmUpdate variable
• Cleaned up orphaned else statement

Improved Go module handling:

• Changed go.mod generation to skip dependencies without explicit versions
• Previously used v0.0.0 placeholder which could cause Go module resolution issues
• Now skips @latest or unversioned dependencies with clear logging
• Users should use go get package@latest to resolve proper versions

Verified merging behavior for all package systems:

• ✅ dependabot.yml - preserves existing entries (docker, github-actions, etc.) and only adds missing ecosystems
• ✅ package.json - merges new npm dependencies with existing ones
• ✅ requirements.txt - merges new pip packages with existing ones, sorted alphabetically
• ✅ go.mod - preserves module declaration and go version, adds new dependencies

Implementation Summary

Core manifest generation (pkg/workflow/dependabot.go):

• Added PipDependency and GoDependency types for structured dependency representation
• Refactored GenerateDependabotManifests to detect and process multiple ecosystems
• Updated generateDependabotConfig to accept ecosystem map for flexible multi-ecosystem configuration

Python (pip) support:

• collectPipDependencies / parsePipPackage: Extract packages from pip install / pip3 install commands
• generateRequirementsTxt: Generate/merge requirements.txt with version specifier support (==, >=, <=, !=, ~=)

Golang support:

• collectGoDependencies / parseGoPackage: Extract packages from go install / go get commands
• extractGoFromCommands: Pattern matching for go install/get with version tags
• generateGoMod: Generate/merge go.mod with module declaration and require blocks

CLI updates (cmd/gh-aw/main.go):

• Updated --dependabot flag help text to document multi-ecosystem support

Test Results

• ✅ All new pip-related tests passing
• ✅ All new golang-related tests passing
• ✅ All multi-ecosystem integration tests passing
• ✅ All existing tests still passing
• ✅ Manual testing verified correct merging behavior

Original prompt

Add dependabot manifest generation add support for

• python (pip)
• Golang

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Agentic Changeset Generator triggered by this pull request.

[Copilot]

Pull Request Overview

This PR extends the dependabot manifest generation feature to support Python (pip) and Golang ecosystems in addition to the existing npm support, enabling multi-ecosystem dependency management for GitHub Actions workflows.

Key changes:

• Added structured dependency types for pip and Go packages with version parsing
• Refactored manifest generation to detect and process multiple ecosystems concurrently
• Implemented ecosystem-specific manifest generation (requirements.txt and go.mod)

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pkg/workflow/dependabot.go	Added pip/Go dependency types, refactored GenerateDependabotManifests for multi-ecosystem support, implemented pip/Go package extraction and manifest generation
pkg/workflow/dependabot_test.go	Added comprehensive test coverage for pip/Go parsing, collection, manifest generation, and multi-ecosystem scenarios
cmd/gh-aw/main.go	Updated CLI help text to document multi-ecosystem support (npm, pip, Go)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

[nitpick] Using 'v0.0.0' as a placeholder for 'latest' versions may cause confusion or issues with Go module resolution. Consider documenting this behavior more clearly or investigating if there's a better placeholder convention for go.mod files that Dependabot can work with.

[Copilot]

Good catch! Fixed in commit 2e24fae. Changed the behavior to skip dependencies without explicit versions instead of using v0.0.0 placeholder. Dependencies with @latest or no version are now skipped with a debug log message suggesting users run go get package@latest to resolve proper versions. This avoids Go module resolution issues.

[pelikhan]

/mergefest

[github-actions]

Agentic Mergefest triggered by this issue comment.

[pelikhan]

@copilot fix build, format, lint, fix tests and fix merging existing dependabot setting files for all package systems.

[Copilot]

@copilot fix build, format, lint, fix tests and fix merging existing dependabot setting files for all package systems.

Fixed in commit 2e24fae:

✅ Build - Resolved syntax error from merge conflict in generateDependabotConfig
✅ Format - No formatting issues
✅ Lint - All checks passing
✅ Tests - All unit tests passing
✅ Merging - Verified merge behavior for all package systems:

• dependabot.yml preserves existing entries (docker, github-actions, etc.)
• package.json merges npm dependencies
• requirements.txt merges pip packages
• go.mod preserves module declaration and merges dependencies

Also improved go.mod generation to skip dependencies without explicit versions instead of using potentially problematic v0.0.0 placeholder.