Dependabot Triage

🤖 Auto-generated by weekly-pattern-learner · obsidian-pr-sync explicitly filters out dependabot/renovate PRs: the user handles them separately, but no skill existed to batch-triage them

Dependabot Triage

Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe, flag what needs a human decision, and report what was done.

Inputs

• Repository (optional): default to the current repo.
• Auto-merge policy (optional, default: patch-only): none, patch-only, or patch-and-minor.
• Require CI (optional, default: on): only merge PRs whose checks are green.

Step 1: Fetch all open dependency PRs

# Dependabot PRs
gh pr list --state open --label "dependencies" \
  --json number,title,author,labels,headRefName,url,isDraft \
  --jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'

# Also catch Renovate PRs not labelled "dependencies"
gh pr list --state open \
  --json number,title,author,labels,headRefName,url,isDraft \
  --jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'

Merge both result sets, deduplicate by number, skip drafts.

Step 2: Classify each PR

Parse the PR title to extract package name and version change.

Dependabot title format: Bump <package> from <old> to <new> Renovate title format: Update dependency <package> to v<new> or chore(deps): update <package>

For each PR:

gh pr view <NUMBER> --json title,body,labels,reviews \
  --jq '{title, body: (.body | .[0:500]), labels: [.labels[].name], reviews: [.reviews[].state]}'

Classify:

When in doubt about the bump type (e.g. non-semver packages), treat as minor.

Step 3: Check CI for merge candidates

For each PR classified as auto-approvable:

gh pr checks <NUMBER> --json name,state,conclusion \
  --jq '[.[] | select(.conclusion != "success" and .conclusion != "skipped")] | length'

If CI is still running, wait up to 10 minutes (polling every 30s). If CI fails, demote to blocked: do not merge a PR with failing checks regardless of policy.

If CI is disabled for dependency PRs in this repo (no checks at all), note it and proceed only when the user has passed --skip-ci-check explicitly.

Step 4: Approve and merge safe PRs

For each auto-approvable PR with green CI:

# Approve
gh pr review <NUMBER> --approve --body "Auto-approved by dependabot-triage: patch bump, CI green."

# Merge (squash is the default; use the repo's configured merge strategy if known)
gh pr merge <NUMBER> --squash --delete-branch \
  --subject "$(gh pr view <NUMBER> --json title --jq .title)"

If the merge fails (conflict, branch protection, etc.), fall back to blocked and note it.

Step 5: Comment on flagged PRs

For each major or blocked PR, post one comment summarizing why it needs a human:

gh pr comment <NUMBER> --body "**dependabot-triage:** This is a major version bump. \
Review the changelog before merging: $(gh pr view <NUMBER> --json body --jq '.body | split("\n") | map(select(test("changelog|release|BREAKING"; "i"))) | .[0]').

No action was taken."

Step 6: Report

Print a digest, then stop. Do not merge anything not listed as approved in this report.

Dependabot triage complete.
  Merged (patch, CI green):   7 PRs  →  lodash 4.17.20→4.17.21, eslint 8.56.0→8.57.0, ...
  Merged (security, CI green): 1 PR  →  axios 1.6.2→1.7.9 (CVE-2024-39338)
  Flagged for human review:    2 PRs →  next.js 14→15 (major), @types/node 20→22 (major)
  Blocked (CI failing):        1 PR  →  typescript 5.4→5.5 (lint errors)
  Skipped (draft):             1 PR

  Open a flagged PR and run /pr-to-green after reviewing the changelog.

Safety guardrails

• Never merge a PR whose author is not dependabot[bot] or renovate[bot], even if found by the label query.
• Never merge a major bump automatically, even if patch-and-minor policy is set.
• Never approve a PR if gh pr checks shows any failure: a quiet pass is not the same as no checks.
• Always post a comment on flagged PRs so the record is visible in the thread.

Chaining