sync-dependabot-app-deps

name	sync-dependabot-app-deps
description	Read every open Dependabot PR for an application-code dependency (Python pip/uv and JS npm/yarn/pnpm) and carry each version bump over to the local dependency files (requirements.txt, pyproject.toml, uv.lock, package.json, package-lock.json/yarn.lock/pnpm-lock.yaml) without merging the PRs.
allowed-tools	Read, Bash, Edit

Sync Dependabot App-Dependency Updates

Dependabot opens one PR per application-code dependency bump across several directories (Python: /, /oss-crs-infra/builder-sidecar, /oss-crs-infra/runner-sidecar, /oss-crs-infra/lifecycle, /oss-crs-infra/litellm-key-gen; JS: /site and any other npm package — see .github/dependabot.yml). This skill collects all the open Python and JS PRs and applies their changes directly to the local working tree, so the bumps land in one local change set instead of N separate merges.

The reliable signal for "this PR is an app-dep bump" is the branch name prefix:

• Python (pip): dependabot/pip/ — used for plain requirements.txt directories
• Python (uv): dependabot/uv/ — used for the root project that ships a uv.lock
• JS (npm / yarn / pnpm): dependabot/npm_and_yarn/

Both Python prefixes must be matched. Dependabot picks uv/ over pip/ for any directory where it detects a uv.lock, regardless of how the directory is declared in .github/dependabot.yml. Missing dependabot/uv/ silently drops the root project's PRs.

GitHub Actions (dependabot/github_actions/) and Docker (dependabot/docker/) PRs are excluded — leave them alone (Docker has its own skill, sync-dependabot-pins).

Step 0 — Start from an up-to-date main on a fresh branch

Make sure the working tree is clean first (git status --short); if there are uncommitted changes, stop and ask the user how to proceed rather than pulling over them. Then update main and cut a dated working branch so the carried-over bumps land in one reviewable branch:

git checkout main
git pull
git checkout -b "chore/app-deps-dependabot-$(date +%Y-%m-%d)"

If the branch already exists (the skill was run earlier today), switch to it instead: git checkout "chore/app-deps-dependabot-$(date +%Y-%m-%d)".

Step 1 — Enumerate the open Python and JS Dependabot PRs

gh pr list --author "app/dependabot" --state open --limit 100 \
  --json number,title,headRefName \
  --jq '.[] | select(.headRefName | startswith("dependabot/pip/") or startswith("dependabot/uv/") or startswith("dependabot/npm_and_yarn/")) | "\(.number)\t\(.headRefName)\t\(.title)"'

If this prints nothing, there are no open Python or JS Dependabot PRs — stop and tell the user there is nothing to sync.

Otherwise, list the matched PR numbers to the user before applying so they know what is about to change. It is helpful to group them by ecosystem (pip vs npm_and_yarn) in the report.

Step 2 — Apply each PR's diff to the local working tree

For each matched PR number N, apply its diff with a 3-way merge. --3way lets two PRs that touch the same file (e.g. one bumps uvicorn, another bumps python-multipart in the same requirements.txt; or two npm bumps that both touch package-lock.json) both land cleanly, and it correctly carries generated lockfile changes (uv.lock, package-lock.json, yarn.lock, pnpm-lock.yaml) that cannot be hand-edited:

for N in <pr numbers, space separated>; do
  echo "=== PR $N ==="
  if gh pr diff "$N" 2>/dev/null | git apply --3way; then
    echo "PR $N applied"
  else
    echo "PR $N did NOT apply cleanly — handle manually (see Step 3)"
  fi
done

Apply them one at a time in the same loop so each result is visible. A PR that applies cleanly prints Applied patch ... cleanly (or nothing on success with plain git apply); a failure is reported explicitly.

Step 3 — Fallback for any PR that does not apply cleanly

git apply can fail when the local file has already diverged from the PR's base (for example, an earlier PR in this same run already changed an adjacent line in a way the 3-way merge could not reconcile, or the PR's lockfile diff references hashes that no longer match). For each such PR:

1. Read the diff to see exactly what changed:

   gh pr diff <N>
   

2. The change is almost always a single dependency constraint, e.g. uvicorn>=0.48.0 → uvicorn>=0.49.0 (Python) or "react": "^18.3.0" → "react": "^18.4.0" (JS). Open the target file named in the diff header (+++ b/<path>) and apply the same edit by hand with the Edit tool.
3. After editing the manifest, regenerate the matching lockfile rather than editing it by hand. Pick the tool that matches the lockfile already present in that directory — do not introduce a different package manager:
   • Python pyproject.toml next to uv.lock → uv lock
   • npm package.json next to package-lock.json → npm install --package-lock-only --prefix <dir>
   • yarn package.json next to yarn.lock → yarn install --cwd <dir>
   • pnpm package.json next to pnpm-lock.yaml → pnpm install --dir <dir> --lockfile-only

Step 4 — Verify the result

git apply --3way stages successful merges, so plain git diff will look empty. Use --cached to see the changes:

git status --short
git diff --cached --stat
git diff --cached -- '*requirements.txt' 'pyproject.toml' '**/package.json'

Every old version constraint from a matched PR should now show as the new version in the staged diff. Lockfile churn (uv.lock, package-lock.json, yarn.lock, pnpm-lock.yaml) will also appear and is expected. Report any PR whose change is missing.

Step 5 — Report

Summarize what was carried over. Do not commit, push, or merge unless the user asks — leave the changes staged in the working tree for their review. Group by ecosystem so the user can copy Closes #N lines into the eventual PR body:

Synced 5 app-dep Dependabot PRs into the working tree:

Python (pip):
  #271  fastapi           >=0.136.3 → >=0.137.1   oss-crs-infra/builder-sidecar/requirements.txt
  #270  fastapi           >=0.136.3 → >=0.137.1   oss-crs-infra/runner-sidecar/requirements.txt
  #266  python-multipart  >=0.0.30  → >=0.0.32    oss-crs-infra/runner-sidecar/requirements.txt
  #265  python-multipart  >=0.0.30  → >=0.0.32    oss-crs-infra/builder-sidecar/requirements.txt

JS (npm_and_yarn):
  #284  @docusaurus/core  ^3.7.0 → ^3.8.0         site/package.json (+ package-lock.json)

Files changed: 2 requirements.txt, 1 package.json, 1 package-lock.json
Not applied: (none)

Mention any PRs that needed the Step 3 fallback, and any that still did not apply so the user can resolve them manually.