# Neilotoole Sq Sq

> sq-gomod-dependabot

- Skill: `tomevault-io/neilotoole-sq-sq` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/neilotoole-sq-sq`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/neilotoole-sq-sq/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/neilotoole-sq-sq

---


# sq-gomod-dependabot

Maintainer workflow for Dependabot PRs updating [`go.mod`](../../../go.mod) /
[`go.sum`](../../../go.sum) at the repository root. For [`site/`](../../../site/)
Bun/Hugo PRs, use [`sq-site-dependabot`](../sq-site-dependabot/SKILL.md).

No `bun.lock` sequencing — multiple gomod PRs are less coupled than site PRs,
but still prefer merging after CI is green.

## Operating modes

| Mode         | Actions                           | Merge  |
| ------------ | --------------------------------- | ------ |
| **Audit**    | List/classify; direct vs indirect | No     |
| **Validate** | Diff review; `make test-short`    | No     |
| **Full**     | Validate + merge with consent     | Per PR |

Default to **Audit** unless the user asks to merge.

## Phase 0 — Tool bootstrap

```bash
command -v gh >/dev/null && gh auth status
command -v go >/dev/null && go version
```

## Phase 1 — Discovery

From repository root:

```bash
gh pr list --author 'app/dependabot' --state open \
  --json number,title,headRefName,mergeable,statusCheckRollup \
  --jq '.[] | select(.headRefName | test("^dependabot/")) | select(.title | test("go|gomod|golang"; "i"))'
```

Confirm the PR does **not** only touch `site/` (`gh pr diff <n> --name-only`). If it
touches both, split judgment: site hunks → `sq-site-dependabot`.

## Phase 2 — Risk

| Level  | Examples                          | Action             |
| ------ | --------------------------------- | ------------------ |
| Low    | Patch indirect, test-only modules | Merge after CI     |
| Medium | Direct minor/patch runtime dep    | Notes + test-short |
| High   | Major, `replace`, breaking sec    | Hold; full review  |

## Phase 3 — Validate

On PR branch:

```bash
make test-short
# or make test for full driver integration (Docker)
```

Review `go mod why` / diff for unexpected indirect churn.

## Phase 4 — Merge (consent-gated)

After required checks pass:

```bash
gh pr merge <n> --squash --delete-branch
```

Use `--admin` only when the user explicitly requests and checks are green.

## Verdict template

```markdown
## Dependabot gomod PR #NNN — <module>

- **Direct/indirect:** …
- **CI:** pass / fail
- **make test-short:** pass / fail
- **Verdict:** merge | hold
```

See [AGENTS.md](../../../AGENTS.md#agent-skills-contributors).

---
> Source: [neilotoole/sq](https://github.com/neilotoole/sq) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-07-01 -->