tutorial

How to Monitor Dependabot with Vigilmon

Dependabot automates dependency updates and security alerts — but if PRs pile up unfixed or Dependabot stops running, your codebase accumulates invisible risk. Here's how to monitor Dependabot with Vigilmon.

Dependabot is GitHub's automated dependency update and security vulnerability scanner. It opens pull requests to bump outdated packages and alerts you to known CVEs in your dependency tree. When Dependabot is working, your security posture stays current without manual effort. But Dependabot can go quiet — misconfigured dependabot.yml, closed or stale PRs that block new ones, security alerts that nobody is triaging, or a GitHub-side outage that pauses updates. Vigilmon gives you an external monitoring layer to catch when your automated dependency hygiene breaks down.

What You'll Set Up

  • HTTP monitor for a Dependabot status endpoint driven by GitHub API polling
  • Cron heartbeat for a scheduled Dependabot-triage script
  • Alerting when security alerts accumulate beyond a threshold

Prerequisites

  • GitHub repository with Dependabot enabled (security alerts and/or version updates)
  • GitHub personal access token or GitHub App with security_events and pulls read scope
  • A free Vigilmon account

Step 1: Enable and Configure Dependabot

Before monitoring Dependabot, make sure it's configured correctly. Create or verify .github/dependabot.yml in your repository:

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
    open-pull-requests-limit: 10
    reviewers:
      - "your-team"

  - package-ecosystem: "docker"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 5

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Commit this file and push. GitHub will start running Dependabot on the configured schedule.

Step 2: Build a Dependabot Status Endpoint

Dependabot doesn't expose a health endpoint — it's a GitHub service. Build a lightweight status server that polls the GitHub API and exposes a /health endpoint for Vigilmon to probe.

// dependabot-status-server.js
const express = require('express');
const { Octokit } = require('@octokit/rest');

const app = express();
const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });

const OWNER = process.env.GITHUB_OWNER;
const REPO = process.env.GITHUB_REPO;
const MAX_OPEN_ALERTS = parseInt(process.env.MAX_OPEN_ALERTS || '10');

let cache = null;
let cacheAt = 0;

async function getStatus() {
  if (Date.now() - cacheAt < 5 * 60 * 1000) return cache; // 5-min cache

  const [alertsRes, prsRes] = await Promise.all([
    octokit.rest.dependabot.listAlertsForRepo({
      owner: OWNER,
      repo: REPO,
      state: 'open',
      per_page: 100,
    }),
    octokit.rest.pulls.list({
      owner: OWNER,
      repo: REPO,
      state: 'open',
      per_page: 100,
    }),
  ]);

  const openAlerts = alertsRes.data;
  const dependabotPRs = prsRes.data.filter(pr =>
    pr.user.login === 'dependabot[bot]'
  );

  const criticalAlerts = openAlerts.filter(a =>
    ['critical', 'high'].includes(a.security_vulnerability?.severity)
  );

  cache = {
    openAlerts: openAlerts.length,
    criticalAlerts: criticalAlerts.length,
    openPRs: dependabotPRs.length,
    oldestAlertDays: openAlerts.length > 0
      ? Math.floor((Date.now() - new Date(openAlerts[0].created_at)) / 86400000)
      : 0,
    timestamp: new Date().toISOString(),
  };
  cacheAt = Date.now();
  return cache;
}

app.get('/health', async (req, res) => {
  try {
    const status = await getStatus();
    const degraded =
      status.criticalAlerts > 0 ||
      status.openAlerts > MAX_OPEN_ALERTS ||
      status.oldestAlertDays > 30;

    res.status(degraded ? 503 : 200).json({
      status: degraded ? 'degraded' : 'ok',
      ...status,
    });
  } catch (err) {
    res.status(503).json({ status: 'error', message: err.message });
  }
});

app.listen(3002, () => console.log('Dependabot status server on :3002'));

Deploy this service on your infrastructure and add it to Vigilmon:

  1. Click Add Monitor → HTTP / HTTPS.
  2. Enter: https://depbot-status.yourcompany.com/health
  3. Set Check interval to 15 minutes.
  4. Set Expected HTTP status to 200.
  5. Click Save.

The monitor goes down whenever:

  • Critical or high severity alerts are open
  • More than 10 open Dependabot PRs are accumulating (blocked by failing checks or ignored)
  • An alert has been open for more than 30 days

Step 3: Cron Heartbeat for a Weekly Dependabot Triage Script

Even with Dependabot creating PRs, those PRs need to be reviewed and merged. Build a weekly triage script that auto-merges safe patch updates and pings Vigilmon to confirm it ran.

#!/usr/bin/env python3
# dependabot-triage.py
import os
import sys
import urllib.request
from github import Github

g = Github(os.environ['GITHUB_TOKEN'])
repo = g.get_repo(f"{os.environ['GITHUB_OWNER']}/{os.environ['GITHUB_REPO']}")
HEARTBEAT_URL = os.environ['VIGILMON_HEARTBEAT_URL']

def is_safe_patch(pr):
    """Return True if this Dependabot PR is a semver patch update."""
    labels = [l.name for l in pr.labels]
    return 'patch' in labels and 'security' not in labels

auto_merged = 0
for pr in repo.get_pulls(state='open'):
    if pr.user.login != 'dependabot[bot]':
        continue
    if not is_safe_patch(pr):
        continue
    checks = list(pr.get_check_runs())
    all_passed = all(c.conclusion == 'success' for c in checks if c.status == 'completed')
    if all_passed and pr.mergeable:
        pr.merge(merge_method='squash')
        auto_merged += 1
        print(f"Auto-merged: {pr.title}")

print(f"Triage complete. Auto-merged {auto_merged} patch PRs.")

# Ping heartbeat on success
req = urllib.request.urlopen(HEARTBEAT_URL, timeout=10)
if req.status != 200:
    sys.exit(1)

Schedule this weekly in GitHub Actions:

# .github/workflows/dependabot-triage.yml
name: Dependabot Triage

on:
  schedule:
    - cron: '0 10 * * 1'  # every Monday at 10am

jobs:
  triage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install PyGithub
      - name: Run triage
        env:
          GITHUB_TOKEN: ${{ secrets.DEPENDABOT_TRIAGE_TOKEN }}
          GITHUB_OWNER: ${{ github.repository_owner }}
          GITHUB_REPO: ${{ github.event.repository.name }}
          VIGILMON_HEARTBEAT_URL: ${{ secrets.VIGILMON_HEARTBEAT_URL }}
        run: python dependabot-triage.py

In Vigilmon, create a heartbeat monitor with a 7-day expected interval for this job.

Step 4: Monitor GitHub's Dependabot Service Status

Dependabot is a GitHub-hosted service — it can pause or fail on GitHub's end. Vigilmon can monitor GitHub's status page for Dependabot-specific incidents.

  1. Click Add Monitor → HTTP / HTTPS.
  2. Enter: https://www.githubstatus.com/api/v2/components.json
  3. Set Check interval to 5 minutes.
  4. Under Response body, set keyword match: "operational" (this checks the raw response includes the word operational).
  5. Click Save.

For a more targeted check, build a small proxy that extracts the Dependabot component status:

# Check Dependabot-specific component status
curl -s https://www.githubstatus.com/api/v2/components.json | \
  jq '.components[] | select(.name | test("Dependabot"; "i")) | {name, status}'

Step 5: Set Up Alerting

  1. Open the Dependabot status HTTP monitor in Vigilmon.
  2. Click Alerting → Add Alert Channel.
  3. Add Slack (to your #security-alerts channel) and Email (to your security lead).
  4. For the HTTP monitor: set trigger to down for 15 minutes.
  5. For the heartbeat monitor: set trigger to missed 1 heartbeat.
  6. Click Save.

Route critical security alert notifications separately from general Dependabot PR backlogs:

  • Critical/high CVEs open > 24 hours → on-call engineer via PagerDuty
  • PR backlog > 10 → weekly digest email to the engineering lead
  • Triage job missed → immediate Slack alert to DevOps

Conclusion

Dependabot is your automated security hygiene — it patches dependencies, surfaces CVEs, and opens PRs so your team doesn't have to monitor vulnerability feeds manually. But Dependabot is only effective if its PRs are getting merged and its alerts are being triaged. A growing PR backlog, ignored critical security alerts, or a silent triage pipeline all represent real security risk.

Vigilmon's HTTP monitor on your Dependabot status endpoint gives you a single dashboard indicator: green means security hygiene is current, red means it needs attention. The cron heartbeat on your triage script ensures automation is actually running. Together, they close the loop on automated dependency management — from Dependabot opening PRs to your team staying on top of them.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles