| name | dep-update |
| description | Review, merge, and release dependency update PRs. Merges green dependabot PRs, closes stale/failing ones, runs full verification, and publishes a patch release. |
| disable-model-invocation | true |
| allowed-tools | Read, Edit, Bash(gh pr *), Bash(gh release *), Bash(gh run *), Bash(git pull *), Bash(git add *), Bash(git commit *), Bash(git push *), Bash(git tag *), Bash(git log *), Bash(git status), Bash(git diff *), Bash(npm install), Bash(npm ci), Bash(npm run typecheck), Bash(npm test), Bash(npm run lint), Bash(npm run build)
|
Dependency Update & Patch Release
Merge open dependency-update PRs and cut a patch release.
IMPORTANT: Only use the tools listed in allowed-tools above. Do NOT use Glob, Grep, Write, WebSearch, WebFetch, Task, or any other tool.
Step 0: Install dependencies
A CI machine starts with a fresh clone. Install before doing anything else:
npm ci
Step 1: List open PRs
gh pr list --repo elixr-games/elics --state open --json number,title,statusCheckRollup,mergeable --jq '.[] | {number, title, checks: [.statusCheckRollup[] | {name: .name, conclusion: .conclusion}]}'
Step 2: Triage each PR
For each open PR, decide:
- Merge if ALL CI checks pass (conclusion: SUCCESS). Merge with
gh pr merge <number> --repo elixr-games/elics --merge.
- Close if CI is failing and the PR is a dependency bump (dependabot will re-open with a newer version). Close with
gh pr close <number> --repo elixr-games/elics --comment "<reason>".
- Close if the PR is outdated (the dependency was already upgraded past the PR's target version in the current codebase). Use
Read to check package.json to confirm.
- Close with comment PRs that can't merge cleanly. Dependabot will re-open.
Merge PRs one at a time. If a merge fails due to conflicts, close that PR and move on.
Step 3: Pull and reinstall
After merging, pull the changes and reinstall dependencies:
git pull --rebase
npm install
Step 4: Full verification
Run all checks. ALL must pass before proceeding:
npm run typecheck
npm test
npm run lint
npm run build
If anything fails, stop. Do NOT release with failures.
Step 5: Patch release
Only proceed if PRs were actually merged in Step 2. If no PRs were merged (all closed or skipped), stop here.
- Use
Read to get the current version from package.json
- Use
Edit to bump the patch version in package.json (e.g., 3.4.1 -> 3.4.2)
- Commit and push:
git add package.json package-lock.json
git commit -m "<version>
Dependency updates:
- <list bumped packages>"
git push origin main
- Tag and release:
git tag v<version>
git push origin v<version>
gh release create v<version> --repo elixr-games/elics --title "v<version>" --notes "<bullet list of merged PRs>"
No changelog entry needed for patch releases.
Step 6: Verify release
gh run list --repo elixr-games/elics --workflow release.yml --limit 1
Report the release workflow status.
Output
Summarize what was done:
- How many PRs merged, closed, skipped
- Which packages were updated
- The new version number
- Release workflow status
