# Dependabot Resolve

> Review and merge dependabot PRs safely using gh CLI. Process one-by-one to avoid package-lock.json conflicts

- Skill: `awinogradov/dependabot-resolve` (Agent Skill)
- Install (CLI): `npx skillmds@latest add awinogradov/dependabot-resolve`
- Raw SKILL.md: https://api.skillmd.com/api/skills/awinogradov/dependabot-resolve/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: awinogradov (https://skillmd.com/u/awinogradov)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/awinogradov/dependabot-resolve

---


Review and merge dependabot PRs safely using gh CLI. Process one-by-one to avoid package-lock.json conflicts.

## Input

Arguments: `$ARGUMENTS`

No arguments are expected. Any supplied arguments are ignored.

## Input resolution

- **Repository** — `gh repo view --json nameWithOwner --jq .nameWithOwner` on the current directory. Do NOT prompt.
- **Open dependabot PRs** — discovered dynamically in [Phase 1](#phase-1-discovery).

## Phase 1: Discovery

1. List all open dependabot PRs using both author formats:
   ```bash
   gh pr list --author "app/dependabot" --state open --json number,title,headRefName
   gh pr list --author "dependabot[bot]" --state open --json number,title,headRefName
   ```
   Merge results from both queries and deduplicate by PR number before proceeding.
2. For each PR, gather:
   - PR number and title
   - Package name and version change (from → to)
   - Update type: major (X.0.0), minor (0.X.0), patch (0.0.X)

## Phase 2: Analysis & Reporting

For each PR, create a report:

| PR  | Package | Change        | Type  | Risk | Breaking Changes         |
| --- | ------- | ------------- | ----- | ---- | ------------------------ |
| #N  | name    | 1.0.0 → 2.0.0 | major | high | [summary from changelog] |

**Risk Levels:**

- **patch** (low): Bug fixes, safe to merge if checks pass
- **minor** (medium): New features, backward compatible, review recommended
- **major** (high): Breaking changes, requires careful review

For major/minor updates, fetch changelog summary:

```bash
gh pr view [number] --json body --jq '.body'
```

## Phase 3: Approval Flow

**All updates require individual approval.** Process one-by-one with context.

Before each approval, show relevant context:

- **Patch:** package, version change, CI status
- **Minor:** package, version change, CI status, changelog summary
- **Major:** package, version change, CI status, full changelog with breaking changes highlighted

Then present approval using AskUserQuestion tool:

Tool parameters:

- `question`: "[TYPE] [package] X.X.X → Y.Y.Y\n\nCI: [pass/fail]\n[changelog summary for minor/major]"
- `header`: "PR #N"
- `options`: [
  { label: "Merge", description: "Approve and merge this update" },
  { label: "Skip", description: "Skip this update for now" }
  ]
- `multiSelect`: false

## Phase 4: Sequential Merge

For each approved PR (one at a time):

### 4.1 Pre-merge checks

```bash
gh pr checks [number] --watch
```

If checks fail → analyze and report fix plan:

1. Fetch failure details:
   ```bash
   gh pr checks [number] --json name,state,conclusion
   gh run view [run-id] --log-failed
   ```
2. Analyze the error (type errors, test failures, lint issues, etc.)
3. Report fix plan:

   ```
   PR #N [package] - CI Failed

   **Error:** [brief description]
   **Cause:** [why this update broke it]
   **Fix:** [1-3 actionable steps to resolve]
   ```

4. Skip this PR, continue to next

### 4.2 Conflict check

```bash
gh pr view [number] --json mergeable --jq '.mergeable'
```

If not mergeable → request rebase from dependabot:

```bash
gh pr comment [number] --body "@dependabot rebase"
```

Report: "Requested rebase for PR #N, will need to re-run /dependabot-resolve later"
Continue to next PR.

### 4.3 Approve & Merge

```bash
gh pr review [number] --approve
gh pr merge [number] --rebase --delete-branch
```

### 4.4 Post-merge

Wait 2-3 seconds before next PR to allow CI to update base branch.

## Phase 5: Session Summary

```
## Dependabot Session Summary

### Merged (N PRs)
| PR | Package | Change | Type |
|----|---------|--------|------|

### Skipped - Failed Checks (N PRs)
| PR | Package | Error | Fix Plan |
|----|---------|-------|----------|

### Rebased - Conflicts (N PRs)
| PR | Package | Status |
|----|---------|--------|
(Requested @dependabot rebase - re-run /dependabot-resolve later)

### Skipped - Not Approved (N PRs)
| PR | Package | Reason |
|----|---------|--------|
```

## Safety Rules

1. **Never force push or skip CI**
2. **Process strictly one-by-one** - wait for merge to complete
3. **Stop on unexpected errors** - report and ask before continuing
4. **Major updates require explicit "yes"** - not just Enter

## Reference formatting

Before writing any output that mentions a file, standard, section, commit, or issue, read [`reference-formatting.md`](../shared-rules/references/reference-formatting.md) (RFC-0001) and apply it verbatim — link files, docs, skills, agents, and sections, and never leave a reference as bare text.