Custom Dependency Pr Solver

Dependency PR Solver

When To Use

Use for an approved batch pass over open Dependabot PRs where the agent may mutate branches, post comments, create changesets, validate, and merge high-confidence updates.

Trigger phrases:

• "process all Dependabot PRs"
• "clear the dependency backlog"
• "batch-process dependency PRs"
• "batch-merge safe Dependabot updates"

Hard Gates

• Read .github/instructions/dependabot-pr.instructions.md before processing any PR.
• Ask for explicit user confirmation before starting the batch and before expanding scope.
• Process only PRs authored by app/dependabot unless the user overrides with a specific PR.
• Rebase onto the PR base branch; never merge the base branch into a Dependabot branch.
• Do not merge major bumps, failing validation, low-confidence updates, or PRs needing manual code changes.
• Always post research and verdict comments before merging.

Inputs

• Repository owner/name, inferred from workspace when possible.
• PR scope: all open Dependabot PRs or an include/exclude list.
• Mode: normal, --review-only, or --merge-medium with explicit user approval.

Workflow

1. List candidates:

gh pr list --author "app/dependabot" --state open --json number,title,headRefName,baseRefName,mergeable,statusCheckRollup

Show a compact table and get confirmation.

2. For each confirmed PR:

   • git fetch origin <base-branch>
   • gh pr checkout <number>
   • git rebase origin/<base-branch>
   • On conflict, abort, mark needs-manual-intervention, and continue to the next PR.
   • Push rebased branch with git push --force-with-lease.

3. Validate dependency state:

   • Run pnpm install --frozen-lockfile.
   • If the lockfile must change, run pnpm install, commit the lockfile-only fix, and push.

4. Review:

   • Delegate analysis to fusion-dependency-review.
   • Capture upstream changes, security notes, existing discussion, impact, and confidence.
   • Post research with assets/research-comment-template.md.

5. Changesets:

   • Follow .github/instructions/dependabot-pr.instructions.md.
   • Create, commit, and push only required changesets.

6. Validate:

pnpm test && pnpm build && pnpm -w check

Attempt only trivial fixes. Mark anything else for manual intervention.

7. Decide:

   • High confidence: post verdict from assets/verdict-comment-template.md, then gh pr merge <number> --squash --admin.
   • Medium confidence: merge only with --merge-medium approval; otherwise report.
   • Low confidence or failed validation: post verdict and do not merge.

8. Finish:

   • Return to main.
   • Report every PR as merged, skipped, failed, or needs manual intervention.

Expected Output

Also include posted-comment status, changeset files, validation results, and manual follow-ups.

Safety

Never merge without validation, comments, and confidence. Never force-push without --force-with-lease. Never continue a conflicted Dependabot rebase by guessing.