refactor: replace python pruner with yq in dependabot scripts

[hyperpolymath]

Removes python dependency.

---

Summary by Gitar

• Scripts & tooling:
  • Replaced Python pruner with yq in scripts/fix-dependabot.sh
  • Updated mise.toml to remove non-existent tools and configure shell runtimes
• Configuration & metadata:
  • Updated .editorconfig and .gitattributes across templates and repository roots

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review ✅ Approved 4 resolved / 4 findings

Replaces the Python pruner with yq in dependabot scripts. Changes requested due to an undeclared yq dependency, potential issues with npm ecosystem pruning, and re-introduction of broken tools in mise.toml.

✅ 4 resolved

✅ Bug: yq dependency undeclared; missing yq breaks idempotent path

📄 scripts/fix-dependabot.sh:12 📄 scripts/fix-dependabot.sh:20-29 📄 mise.toml:1-15
The script runs under set -euo pipefail and now calls yq -i in the existing-file branch, but never checks that yq is installed and yq is not declared in mise.toml (the sibling script fix-dependabot-coverage.sh:54 does guard with command -v yq). Previously an existing dependabot.yml was a safe no-op skip; now if yq is absent the script aborts non-zero on a path that used to succeed, and the PR's stated goal of 'removing the python dependency' merely swaps it for an undeclared yq dependency. Add a command -v yq guard (mirroring fix-dependabot-coverage.sh) and/or declare yq in mise.toml [tools].

✅ Bug: Prune deletes npm ecosystem that the create path adds; can empty updates

📄 scripts/fix-dependabot.sh:21-28 📄 scripts/fix-dependabot.sh:42-44
When a dependabot.yml exists the prune deletes every package-ecosystem == "npm" entry, yet the generation path below (lines 42-44) still adds npm whenever package.json is present — so a freshly created file contains exactly what a re-run would strip, and the two paths contradict each other. Worse, for a JS-only repo whose dependabot.yml lists only npm, del(.updates[] ...) leaves an empty updates: list, which is an invalid Dependabot config that GitHub rejects. Reconcile the two code paths (either stop emitting npm, or don't prune it) and skip/guard when pruning would empty updates.

✅ Quality: mise.toml reverts documented cleanup; re-adds non-resolving tools

📄 mise.toml:1-15
This diff removes the explanatory block added in commit 34406ad and re-introduces exactly the entries that commit removed as broken: denojs (registry name is deno), go-task and git/gnu-sed/gnu-tar/gnu-grep (do not resolve / shadow base binaries), vitest/jest/pytest/isort (project deps, not toolchain tools), and an [alias] block used as if it defined tasks — mise treats [alias] as tool-plugin aliases (and warns it is deprecated), so build/test/lint/fmt never run. The result reinstates the ~25 lines of install-time warnings the earlier cleanup fixed. Restore the corrected tool set or, if these tools are genuinely needed, use their real registry names and move tasks to the Justfile/[tasks] rather than [alias].

✅ Quality: .gitignore now ignores .editorconfig while PR edits it

📄 .gitignore:153
This PR adds .editorconfig to .gitignore at the same time it substantially edits .editorconfig files. Already-tracked files stay tracked, but any new/regenerated .editorconfig (e.g. in the skeleton template) will be silently untracked, which can break the template output. Confirm this is intentional; if only a specific path should be ignored, scope the pattern rather than ignoring all .editorconfig files.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}