# Mpt Ext Workflow Fix Dependabot Prs

> Process open Dependabot PRs end to end: apply the shared dependency policy, validate, and push the fixes back to the same upstream branches for review.

- Skill: `softwareone-platform/mpt-ext-workflow-fix-dependabot-prs` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add softwareone-platform/mpt-ext-workflow-fix-dependabot-prs`
- Raw SKILL.md: https://api.skillmd.com/api/skills/softwareone-platform/mpt-ext-workflow-fix-dependabot-prs/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- Author: softwareone-platform (https://skillmd.com/u/softwareone-platform)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/softwareone-platform/mpt-ext-workflow-fix-dependabot-prs

---


# Fix Dependabot PRs

## Purpose

Coordinate the full SoftwareOne Dependabot PR remediation workflow for extension repositories.

## Use When

- The user wants to process one or more open Dependabot PRs in a `softwareone-platform` extension repository.
- Dependabot PRs may need dependency-policy fixes before review or merge.
- The workflow must validate the result and push fixes back to the original upstream Dependabot branches.
- Validation failures may need scoped follow-up fixes before the branch can be published.

## Do Not Use When

- The PR is not authored by Dependabot.
- The user wants to bump dependencies manually from a normal feature branch.
- The task is only to apply the dependency policy fix to an already selected PR or checked-out branch.
- The task requires changing shared dependency policy rather than applying it.
- The repository does not follow the shared Python dependency-management and validation workflow.

## Inputs

- Target repository under the `softwareone-platform` organization.
- Open Dependabot PR number, or permission to process all open Dependabot PRs in the repository.
- GitHub authentication that can read PR metadata and push to Dependabot branches in the upstream repository.
- Local Git checkout of the target upstream repository.
- Repository dependency and validation workflow that follows the shared package guidance.
- Python 3.12 or later is available as `python3` for bundled deterministic scripts.

## Shared References

Use these shared documents as the source of truth instead of restating their policy. When shared guidance is needed, resolve it from `${MPT_EXTENSION_SKILLS_HOME:-$HOME/.mpt-extension-skills}/current` when available; otherwise read the same path from the `main` branch of the shared GitHub repository.

- `standards/packages-and-dependencies.md`
- `knowledge/manage-dependencies.md`
- `knowledge/build-and-checks.md`
- `standards/pull-requests.md`
- `skills/mpt-ext-task-dependabot-pr-policy-fix/SKILL.md`
- `skills/mpt-ext-task-run-repository-checks/SKILL.md`
- `skills/mpt-ext-task-fix-repository-check-failures/SKILL.md`

## Workflow

1. Build repository context first.
- Read the target repository `AGENTS.md` once per session. If you already loaded it earlier in this session and still have its full contents, reuse them instead of re-reading; if the context was summarized or you are unsure it is complete, read it again. Do not pre-load shared docs in this step; read them lazily only when the repository points to them.
- Read repository-specific docs when they exist, because they may extend or override shared guidance.
- Read shared docs only when the repository explicitly points to them, using the resolution rule from Shared References.

2. Find the target Dependabot PRs.
- If the user provided a PR number, inspect only that PR.
- Otherwise list open Dependabot PRs in the upstream repository:

```bash
gh pr list --repo softwareone-platform/<repo> --state open --author 'dependabot[bot]' --limit 200 --json number,title,url,headRefName,baseRefName
```

- Collect PR number, title, URL, head branch, and base branch.

3. Read and classify each PR before changing anything.
- Read PR metadata, changed files, and diff.
- Verify the PR head branch is a Dependabot branch.
- Verify the changed files are dependency-related before applying this workflow.
- Use the analyzer bundled with the policy-fix task for repeatable classification:

```bash
python3 "${MPT_EXTENSION_SKILLS_HOME:-$HOME/.mpt-extension-skills}/current/skills/mpt-ext-task-dependabot-pr-policy-fix/scripts/analyze_dependabot_pr.py" \
  --metadata-json pr.json \
  --changed-files-json files.json \
  --diff-file pr.diff \
  --pretty
```

- Skip PRs that are not Dependabot-authored, are not dependency-related, or have no relevant policy signal.

4. Check out the exact Dependabot branch.
- Fetch the base and head branches from upstream.
- Check out the existing Dependabot branch directly.
- Rebase the Dependabot branch on the latest base branch before editing:

```bash
git fetch origin <base-branch> <head-branch>
git checkout <head-branch>
git pull --rebase origin <base-branch>
```

- Do not create a new work branch.

5. Apply dependency-policy fixes.
- Invoke `mpt-ext-task-dependabot-pr-policy-fix` for the selected PR or checked-out Dependabot branch.
- Keep the task scoped to dependency-policy files and dependency lock refresh.
- Record changed files and fixed rules for the final report.

6. Run repository checks.
- Invoke `mpt-ext-task-run-repository-checks` using the repository-defined validation flow.
- If the repository follows the shared validation guidance and `uv.lock` changed, run `make build` before `make check-all`.
- Preserve command output with the command that produced it.

7. Fix actionable validation failures.
- If validation fails, hand the failing output to `mpt-ext-task-fix-repository-check-failures` once; that task owns the bounded fix-and-rerun loop. Do not re-loop it from here.
- Constrain the fix scope to failures clearly caused by the Dependabot dependency change, dependency lock refresh, pre-commit pin sync, or validation fallout from those files.
- Act on its returned outcome: continue to publishing only on `fixed`; on any other outcome — including failures that are environment-related, unrelated to the Dependabot change, or that need a product or design decision — stop without committing or pushing and record the blocker.

8. Amend and push to the same Dependabot branch.
- Stage only files from the recorded changed-file list produced by the policy-fix and validation-fix steps.
- After staging, check whether there are staged changes before amending:

```bash
git add <recorded-changed-file>...
git diff --cached --quiet
```

- If there are no staged changes, skip `git commit --amend --no-edit` and `git push --force-with-lease`, then report the PR as validated with no publishable changes.
- If staged changes exist, amend the existing Dependabot commit and push it back to the same upstream branch:

```bash
git commit --amend --no-edit
git push --force-with-lease origin <head-branch>
```

- Do not create a new PR and do not push to a personal fork.

9. Report results.
- Record processed, skipped, fixed, pushed, and blocked PRs.
- Include PR number and URL, status, fixed rules, changed files, validation commands and results, amended commit SHA, push result, and skip or blocker reasons.
- Render the multi-PR report deterministically: collect the per-PR result objects into a JSON file and pass it to the bundled `render_result.py` for a stable Markdown summary.

```bash
python3 "${MPT_EXTENSION_SKILLS_HOME:-$HOME/.mpt-extension-skills}/current/skills/mpt-ext-workflow-fix-dependabot-prs/scripts/render_result.py" \
  --results-json results.json
```

## Guardrails

- Never process non-Dependabot PRs with this workflow.
- Never create new branches or pull requests for Dependabot remediation.
- Never push fixes anywhere except the original Dependabot branch in upstream.
- Never restate or diverge from the dependency-policy rules that `mpt-ext-task-dependabot-pr-policy-fix` owns (broad `pyproject.toml` specifiers, `opentelemetry`-family bumps, opportunistic `.pre-commit-config.yaml` edits); delegate them to that task.
- Never continue to amend or push after failed validation unless the failure has been fixed and the required validation flow passes.
- Never wrap a fix task that already owns its bounded loop in a second retry loop; invoke it once per Dependabot PR, consume its classified outcome, and stop on anything other than success.
- Never use validation auto-fix as permission to make unrelated product-code changes in a Dependabot PR.
- Never run repository-required validation steps in parallel when the shared validation workflow requires a sequence.

## Expected Outcome

Relevant open Dependabot PRs are fixed in their existing upstream branches, repository-required checks pass, amended Dependabot commits are pushed back for review, and skipped or blocked PRs are reported with precise reasons.