How do I install the Dependabot Pr Automation skill?

Run npx skillmds@latest add chainloop-dev/dependabot-pr-automation in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Dependabot Pr Automation safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Dependabot Pr Automation?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Dependabot Pr Automation free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Dependabot Pr Automation?

chainloop-dev (@chainloop-dev) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Dependabot Pr Automation by chainloop-dev

Name: Dependabot Pr Automation
Author: chainloop-dev

Dependabot Pr Automation

Reviews open Dependabot pull requests, assesses their risk level based on version bump type and CI status, approves low-risk PRs, and merges them. Use when asked to process, review, merge, or triage Dependabot PRs.

File contents

Dependabot PR Automation for chainloop

This skill reviews open Dependabot pull requests, assesses their risk, approves safe ones, and merges them.

Repository Info

Item	Value
Owner	`chainloop-dev`
Repo	`chainloop`

Step 1: List Open Dependabot PRs

Use mcp__github__list_pull_requests to fetch open PRs:

owner: chainloop-dev
repo: chainloop
state: open

Filter the results to only include PRs authored by dependabot[bot]. Collect each PR's number, title, head branch, and labels.

If there are no open Dependabot PRs, report that and stop.

Step 2: Assess Risk for Each PR

For each Dependabot PR, determine the risk level using these criteria:

2a. Parse Version Bump from PR Title

Dependabot PR titles follow the pattern: Bump <package> from <old-version> to <new-version>. Extract the old and new versions and classify the bump:

Bump Type	Risk Level	Criteria
Patch (x.x.OLD → x.x.NEW)	Low	Only the patch segment changed
Minor (x.OLD.x → x.NEW.x)	Medium	The minor segment changed
Major (OLD.x.x → NEW.x.x)	High	The major segment changed

2b. Check CI / Check Status

Use mcp__github__get_pull_request_status to retrieve the CI check status for each PR. A PR is considered CI-passing only if all checks have concluded with a success state.

2c. Inspect the Diff

Use mcp__github__get_pull_request_files to review the files changed. Flag any PR that modifies unexpected files beyond dependency manifests (go.mod, go.sum, package.json, yarn.lock, Dockerfile*, .github/workflows/*).

2d. Identify Dependency Scope

Development-only (test frameworks, linters, dev tools) → Lower risk
Production (runtime dependencies) → Higher risk
GitHub Actions (workflow dependencies) → Typically low risk for minor/patch bumps

2e. Final Risk Matrix

Version Bump	CI Passing	Only Manifest Files	Final Risk	Action
Patch	Yes	Yes	Low	Auto-approve and merge
Patch	No	Yes	Medium	Approve but do not merge
Minor	Yes	Yes	Medium	Auto-approve and merge
Minor	Yes	No	High	Do not approve
Minor	No	*	High	Do not approve
Major	*	*	High	Do not approve

GitHub Actions patch and minor bumps with passing CI → Low risk.

Step 3: Approve Eligible PRs

Use mcp__github__create_pull_request_review with event: APPROVE for eligible PRs.

Step 4: Merge Approved PRs

Use mcp__github__merge_pull_request with merge_method: squash. If the merge fails, note the failure and continue.

Step 5: Report Results

After processing all PRs, produce a summary table showing merged, approved-pending, flagged, and errored PRs.

Important Notes

Never force-merge.
Respect branch protection rules.
Go module PRs may need go mod tidy after merge.
Process oldest-first to avoid dependency tree conflicts.
Security-labeled PRs should be prioritized; treat security patch/minor bumps as Low risk if CI passes.

---name: dependabot-pr-automationdescription: Reviews open Dependabot pull requests, assesses their risk level based on version bump type and CI status, approves low-risk PRs, and merges them. Use when asked to process, review, merge, or triage Dependabot PRs.---# Dependabot PR Automation for chainloopThis skill reviews open Dependabot pull requests, assesses their risk, approves safe ones, and merges them.## Repository Info| Item | Value ||------|-------|| Owner | `chainloop-dev` || Repo | `chainloop` |## Step 1: List Open Dependabot PRsUse `mcp__github__list_pull_requests` to fetch open PRs:- `owner`: `chainloop-dev`- `repo`: `chainloop`- `state`: `open`Filter the results to only include PRs authored by `dependabot[bot]`. Collect each PR's number, title, head branch, and labels.If there are no open Dependabot PRs, report that and stop.## Step 2: Assess Risk for Each PRFor each Dependabot PR, determine the risk level using these criteria:### 2a. Parse Version Bump from PR TitleDependabot PR titles follow the pattern: `Bump <package> from <old-version> to <new-version>`. Extract the old and new versions and classify the bump:| Bump Type | Risk Level | Criteria ||-----------|------------|----------|| **Patch** (x.x.OLD → x.x.NEW) | Low | Only the patch segment changed || **Minor** (x.OLD.x → x.NEW.x) | Medium | The minor segment changed || **Major** (OLD.x.x → NEW.x.x) | High | The major segment changed |### 2b. Check CI / Check StatusUse `mcp__github__get_pull_request_status` to retrieve the CI check status for each PR. A PR is considered CI-passing only if all checks have concluded with a success state.### 2c. Inspect the DiffUse `mcp__github__get_pull_request_files` to review the files changed. Flag any PR that modifies unexpected files beyond dependency manifests (`go.mod`, `go.sum`, `package.json`, `yarn.lock`, `Dockerfile*`, `.github/workflows/*`).### 2d. Identify Dependency Scope- **Development-only** (test frameworks, linters, dev tools) → Lower risk- **Production** (runtime dependencies) → Higher risk- **GitHub Actions** (workflow dependencies) → Typically low risk for minor/patch bumps### 2e. Final Risk Matrix| Version Bump | CI Passing | Only Manifest Files | Final Risk | Action ||-------------|------------|---------------------|------------|--------|| Patch | Yes | Yes | **Low** | Auto-approve and merge || Patch | No | Yes | **Medium** | Approve but do not merge || Minor | Yes | Yes | **Medium** | Auto-approve and merge || Minor | Yes | No | **High** | Do not approve || Minor | No | * | **High** | Do not approve || Major | * | * | **High** | Do not approve |GitHub Actions patch and minor bumps with passing CI → **Low** risk.## Step 3: Approve Eligible PRsUse `mcp__github__create_pull_request_review` with `event: APPROVE` for eligible PRs.## Step 4: Merge Approved PRsUse `mcp__github__merge_pull_request` with `merge_method: squash`. If the merge fails, note the failure and continue.## Step 5: Report ResultsAfter processing all PRs, produce a summary table showing merged, approved-pending, flagged, and errored PRs.## Important Notes- Never force-merge.- Respect branch protection rules.- Go module PRs may need `go mod tidy` after merge.- Process oldest-first to avoid dependency tree conflicts.- Security-labeled PRs should be prioritized; treat security patch/minor bumps as Low risk if CI passes.

Frequently asked questions