| name | dependabot |
| description | Handle open dependabot PRs automatically. Finds the oldest open dependabot PR, classifies it, applies the version bump to the branch, merges main to eliminate conflicts, and posts a summary comment. Merging is left to the maintainer. Use this skill whenever the user says "handle dependabot PRs", "take care of dependabot", "process dependabot updates", "triage dependabot", "deal with dependabot", or anything similar about pending dependabot pull requests. |
Overview
Processes the oldest open dependabot PR and makes it ready for maintainer review. Applies the dependency bump to the branch first, then merges the latest main to ensure the branch is conflict-free.
Dependency types:
- Direct: declared in
pyproject.toml — bump the version constraint and regenerate the lock file.
- Indirect-python: transitive dep, not in
pyproject.toml — regenerate the lock file only.
- GitHub Actions: bump the action version in workflow files.
Merging is left to the maintainer.
Workflow
Step 1 — Discover open dependabot PRs
gh pr list --author app/dependabot --state open --json number,title,headRefName,url --jq 'sort_by(.number)'
Stop and report if no PRs are found. Select the one with the lowest PR number as the target.
Step 2 — Classify the PR
Extract the package name (token after "Bump", lowercased). Search pyproject.toml ([project].dependencies and all [dependency-groups] keys) for that name (case-insensitive):
- direct: found — note the group (
project, dev, doc, etc.) and current constraint (e.g. >=0.0.53).
- indirect-python: Python package, not found in
pyproject.toml.
- github-actions: owner/action pattern (e.g.
actions/checkout).
Print the classification and target version, then ask: "Ready to process this PR?" Wait for confirmation before touching any branch.
Step 3 — Process the PR branch
3a. Check out the branch
git fetch origin
git checkout <headRefName>
3b. Apply the version bump
Direct PR: run uv add for this entry, then regenerate the lock file:
[project].dependencies → uv add "<package>>=<target-version>"[dependency-groups] dev → uv add --group dev "<package>>=<target-version>"[dependency-groups] doc → uv add --group doc "<package>>=<target-version>"
Preserve the existing constraint operator.
make venv
Indirect-python PR: no pyproject.toml change. Regenerate the lock file only:
make venv
GitHub Actions PR: replace the old version with the new across all workflow files:
perl -pi -e 's|<action>@<old-version>|<action>@<new-version>|g' .github/workflows/*.yml
If make venv fails, check out main, record the failure, notify the user, and stop.
3c. Commit the version bump
git add pyproject.toml uv.lock .github/workflows/
git commit -m "chore: apply dependabot update"
If git commit says "nothing to commit", note it and continue to 3d.
3d. Merge main
git merge origin/main
If the merge is clean (no conflicts) or already up-to-date, skip to 3f.
If there are conflicts, resolve each type as follows:
pyproject.toml conflicts: for each conflict block, compare the version strings from both sides and keep the higher version. Remove all conflict markers.
git add pyproject.toml
uv.lock conflicts: always resolve by regenerating:
make venv
git add uv.lock
.github/workflows/ conflicts: for each conflict block, keep the higher version string. Remove all conflict markers.
git add .github/workflows/
If make venv fails during conflict resolution, abort the merge (git merge --abort), check out main, record the failure, notify the user, and stop.
3e. Commit the merge resolution
Only needed when conflicts were present:
git commit --no-edit
3f. Push
git push origin <headRefName>
If push is rejected, check out main, record the failure, notify the user, and stop.
3g. Post a comment
Template:
Processed by the dependabot skill.
Changes applied to this branch:
- `pyproject.toml`: bumped `<package>` from `<old-constraint>` to `>=<target>` (group: `<group>`)
- `uv.lock`: deleted and regenerated via `make venv`
- `.github/workflows/`: updated `<action>` from `<old-version>` to `<new-version>`
Merged latest main. Ready for maintainer review.
Rules:
- Omit sections that are empty (no Python entry, no GHA entry).
- If the merge resolved conflicts, add:
Note: conflicts in <files> were resolved automatically.
- If the branch was already up-to-date with main, omit the "Merged latest main" line.
gh pr comment <number> --body "<comment body>"
3h. Return to main
git checkout main
Step 4 — Final summary
Print the PR number, package/action name, type (direct / indirect-python / github-actions), and outcome (e.g. "processed and pushed" or "failed: ").
Important constraints
- Confirm before acting. Wait for user confirmation after Step 2.
- Process first, merge second. Apply the version bump and commit before merging main.
- Never merge. Leave approvals and merging to the maintainer.
- Never force-push.
- Preserve constraint operators. Never change
>= to == or vice versa.
- Oldest PR first. Always select the PR with the lowest number.
