dependency-sweeper

Stars12

Forks3

UpdatedJuly 20, 2026 at 13:52

Nightly sweep of outdated dependencies. Tests each candidate update in a throwaway worktree and reports the result. Read-only outside its own sandbox — does not open a PR until promoted past L1.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

ayeshakhalid192007-dev

ayeshakhalid192007-dev/LoopEngineering-CrashCourse

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

SKILL.md

readonly

name	dependency-sweeper
description	Nightly sweep of outdated dependencies. Tests each candidate update in a throwaway worktree and reports the result. Read-only outside its own sandbox — does not open a PR until promoted past L1.

dependency-sweeper procedure

The prompt carries intent; this skill carries the procedure — keep it a checklist, not an essay.

Read — the manifest and lockfiles for outdated production dependencies not yet in dependency-sweeper-state.md's per-package register.
Do one unit — for up to 10 outdated packages this beat: in a fresh, throwaway worktree, apply the candidate update and run the full test suite.
Verify and record the outcome:
- Suite green → write a dependency-report.md entry: package, target version, suite result. Do NOT open a PR at L1.
- Suite red → retry once in a clean worktree. Still red → write a blocked entry (version, failing check, retry count) and do not retry again until the version changes upstream.
Record — update dependency-sweeper-state.md's per-package status, append one line to loop-run-log.md, commit both. Discard the throwaway worktree.
Take NO other action — no PRs, no pushes, nothing outside the scratch worktree survives the beat. This loop is L1 report-only until a human promotes it (see LOOP.md → Promotion to L2).

More from this repository

same repository

stale-safe-batch-release

ayeshakhalid192007-dev/LoopEngineering-CrashCourse

Reviews pending PRs, excludes stale/unfinished work, combines the rest into a release batch built from main. Read-only — reports the batch, never actually releases.

2026-07-2012

spec-dev-review

ayeshakhalid192007-dev/LoopEngineering-CrashCourse

Writes a scoped spec packet for one ticket, reviewed by a genuinely independent adversarial pass that also regression-checks prior findings. Read-only outside the draft — never writes the canonical spec.

2026-07-2012

codex-completion-contract

ayeshakhalid192007-dev/LoopEngineering-CrashCourse

Defines every required outcome and its evidence before acting on long-running work, then audits each requirement as proved/weak/missing/ contradicted. Only run when explicitly asked for a completion audit.

2026-07-2012

loop-harness-verification

ayeshakhalid192007-dev/LoopEngineering-CrashCourse

General-purpose harness for scheduled repo work — stage in an isolated worktree, verify with a genuinely separate second session, ship only after a pass. Read-only — reports, never delivers.

2026-07-2012

clodex-adversarial-review

ayeshakhalid192007-dev/LoopEngineering-CrashCourse

Runs an adversarial review cycle against a PR (Claude implements/fixes, Codex or a subagent stand-in reviews), up to 5 iterations. Read-only on the real PR — drafts fixes, never pushes them.

2026-07-2012

ticket-to-pr-ready

ayeshakhalid192007-dev/LoopEngineering-CrashCourse

Turns a ticket or bug report into a review-ready patch. Read-only — reproduces, roots out the cause, drafts a fix, reports it. Never opens a PR, never folds in unrelated refactors.

2026-07-2012

name	dependency-sweeper
description	Nightly sweep of outdated dependencies. Tests each candidate update in a throwaway worktree and reports the result. Read-only outside its own sandbox — does not open a PR until promoted past L1.

dependency-sweeper procedure

The prompt carries intent; this skill carries the procedure — keep it a checklist, not an essay.

Read — the manifest and lockfiles for outdated production dependencies not yet in dependency-sweeper-state.md's per-package register.
Do one unit — for up to 10 outdated packages this beat: in a fresh, throwaway worktree, apply the candidate update and run the full test suite.
Verify and record the outcome:
- Suite green → write a dependency-report.md entry: package, target version, suite result. Do NOT open a PR at L1.
- Suite red → retry once in a clean worktree. Still red → write a blocked entry (version, failing check, retry count) and do not retry again until the version changes upstream.
Record — update dependency-sweeper-state.md's per-package status, append one line to loop-run-log.md, commit both. Discard the throwaway worktree.
Take NO other action — no PRs, no pushes, nothing outside the scratch worktree survives the beat. This loop is L1 report-only until a human promotes it (see LOOP.md → Promotion to L2).