fix(health): accept dependabot.yaml as well as dependabot.yml

GitHub reads Dependabot's config from either name. The lookup now tries
.yml first and .yaml only when that is a 404; only two 404s mean there
is no config. Any other error still counts as configured.

Author: Seungpyo1007

machine/health.py

@@ -7,9 +7,9 @@
 days. This treats anything other than success/skipped as a problem.
 
 One exception: GitHub's dynamic "Dependabot Updates" workflow cannot be
-disabled, and its old runs outlive the `.github/dependabot.yml` that started
-them. Without that file no version update can run, so in a repository that
-has none the workflow is skipped as a leftover.
+disabled, and its old runs outlive the `.github/dependabot.yml` (or `.yaml`)
+that started them. Without that file no version update can run, so in a
+repository that has neither the workflow is skipped as a leftover.
 
 It only reads. The report goes to stdout and the run's step summary; nothing
 is written to GitHub and nobody is mentioned, so it runs only when a person
@@ -46,6 +46,7 @@
 
 # GitHub's own workflow for Dependabot, present even after its config is gone.
 DEPENDABOT_WORKFLOW = "dynamic/dependabot/"
+DEPENDABOT_CONFIGS = ("dependabot.yml", "dependabot.yaml")
 
 
 @dataclass
@@ -131,18 +132,23 @@ def workflow_token_findings(repo: str, branch: str, workflow: dict[str, Any],
 
 
 def dependabot_configured(repo: str, token: str | None) -> bool:
-    """Whether the repository has `.github/dependabot.yml` on its default branch.
+    """Whether the repository has `.github/dependabot.yml` or `.yaml` on its default branch.
 
-    A 404 means it has none. Any other failure counts as configured, so a
-    lookup that went wrong never hides a real Dependabot failure.
+    GitHub accepts either name, so `.yaml` is tried only when `.yml` is a 404,
+    and only two 404s mean there is none. Any other failure counts as
+    configured, so a lookup that went wrong never hides a real Dependabot failure.
     """
-    try:
-        _get(f"{API}/repos/{repo}/contents/.github/dependabot.yml", token)
-    except urllib.error.HTTPError as exc:
-        return exc.code != 404
-    except urllib.error.URLError:
+    for name in DEPENDABOT_CONFIGS:
+        try:
+            _get(f"{API}/repos/{repo}/contents/.github/{name}", token)
+        except urllib.error.HTTPError as exc:
+            if exc.code == 404:
+                continue
+            return True
+        except urllib.error.URLError:
+            return True
         return True
-    return True
+    return False
 
 
 def leftover_workflow(workflow: dict[str, Any], has_dependabot_config: bool) -> bool:

tests/test_health.py

@@ -2,6 +2,10 @@
 
 from __future__ import annotations
 
+import urllib.error
+
+from machine import health
+
 from machine.health import endpoint_finding, latest_runs, leftover_workflow, render, run_findings
 
 
@@ -47,6 +51,31 @@ def test_dependabot_workflow_without_config_is_a_leftover():
     assert not leftover_workflow(dependabot, has_dependabot_config=True)
 
 
+def _contents(present: set[str]):
+    """A stand-in for `_get` where only the named .github files exist."""
+    def get(url: str, token: str | None) -> dict:
+        if url.rsplit("/", 1)[1] not in present:
+            raise urllib.error.HTTPError(url, 404, "Not Found", None, None)
+        return {}
+    return get
+
+
+def test_either_dependabot_file_counts_as_configured(monkeypatch):
+    monkeypatch.setattr(health, "_get", _contents({"dependabot.yml"}))
+    assert health.dependabot_configured("org/repo", None)
+    monkeypatch.setattr(health, "_get", _contents({"dependabot.yaml"}))
+    assert health.dependabot_configured("org/repo", None)
+    monkeypatch.setattr(health, "_get", _contents(set()))
+    assert not health.dependabot_configured("org/repo", None)
+
+
+def test_a_failed_lookup_keeps_dependabot_checked(monkeypatch):
+    def forbidden(url: str, token: str | None) -> dict:
+        raise urllib.error.HTTPError(url, 403, "Forbidden", None, None)
+    monkeypatch.setattr(health, "_get", forbidden)
+    assert health.dependabot_configured("org/repo", None)
+
+
 def test_other_workflows_are_never_leftovers():
     pages = {"name": "pages-build-deployment", "path": "dynamic/pages/pages-build-deployment"}
     ci = {"name": "test", "path": ".github/workflows/test.yml"}