Dependabot docs disagree on when the ecosystem label is added, and on its name (github-actions vs github_actions)

[djcesar]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

• https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#labels--
• https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/customizing-dependabot-prs (its default-labels text comes from data/reusables/dependabot/default-labels.md)

What part(s) of the article would you like to see updated?

The two articles describe Dependabot's default labels in ways that contradict each other:

1. When the ecosystem label is added. The options reference (labels → "Dependabot default behavior") says the ecosystem label is added only when more than one package manager is defined. The customizing article (the default-labels reusable) says both the dependencies label and the ecosystem label are added to all pull requests, single-ecosystem updates included. Both can't be right; the observed behavior matches the second (see below).

2. The name of the GitHub Actions ecosystem label. The reusable uses github-actions as an example, but the label Dependabot actually creates and applies is github_actions, with an underscore.

Expected outcome: both articles state the same rule for the ecosystem label, and the GitHub Actions example uses the label name Dependabot really applies.

Additional information

Reproduced in a private repository whose dependabot.yml has a single entry (package-ecosystem: github-actions, no labels option) and that had neither label beforehand. Dependabot's first version-update pull request created both labels and applied them: the pull request's events show dependabot[bot] adding dependencies and github_actions. The github_actions label it created had the description "Pull requests that update GitHub Actions code".