merge-dependabot-prs

name	merge-dependabot-prs
description	Discover, evaluate, and optionally merge open Dependabot pull requests with dependency-aware ordering and post-merge verification. Use when asked to process or merge Dependabot PRs for a repository.

Merge Dependabot PRs

Contents

• Workflow
• Authorization
• Discovery and baseline
• Cleanup and report
• references/library-evaluation.md
• references/actions-evaluation.md
• references/merge.md

Workflow

Treat owner/repo as the primary input and infer it from local remotes when possible.

1. Follow Discovery and baseline to inventory PRs, establish a healthy baseline, classify updates, and order work units.
2. Before evaluating library updates, read references/library-evaluation.md. Do not load the Actions evaluation template unless the run also includes Actions updates.
3. Before evaluating GitHub Actions updates, read references/actions-evaluation.md. Do not load the library evaluation template unless the run also includes library updates.
4. If merging is authorized and PASS work units exist, read references/merge.md immediately before the first merge.
5. Follow Cleanup and report after evaluation or merging.

Evaluate work units sequentially unless the user explicitly requested parallel agents. Any editing subagent must use an isolated worktree.

Authorization

Processing can mean evaluation without mutation. Do not approve, merge, push, comment, or open a configuration PR unless the user explicitly authorized those GitHub writes. Before the first write, confirm the exact repository, PR set, merge method, and current branch-protection status.

Discovery and baseline

Repository and configuration

Use the supplied checkout when suitable; otherwise clone the exact owner/repo into a fresh temporary directory. Resolve the default branch from GitHub rather than assuming main.

Inspect .github/dependabot.yml and active manifests for ecosystem coverage, correct directories, weekly scheduling, a seven-day cooldown, and useful grouping. A repository with uv.lock should use Dependabot's uv ecosystem for that directory. Preserve repository-specific labels, reviewers, limits, and schedules. Report configuration gaps; create a corrective branch or PR only when that external work is explicitly authorized.

Open pull requests

List open pull requests authored by Dependabot with number, title, head ref, changed files, labels, mergeability, checks, and dependency metadata.

Classify a PR as an Actions update only when all changed files are under .github/workflows/ or .github/actions/. Classify every other dependency update as a library update.

Healthy baseline

Check out and update the default branch. Discover required commands from project instructions, CI, manifests, lockfiles, and task runners. Use the development-standards skill only for missing generic guidance.

Run the CI-required and change-relevant baseline build and tests. Use a full suite when repository policy, CI, or the breadth of queued dependency changes justifies it. If the default branch is unhealthy, stop before evaluating PRs and report the failing baseline.

Record the dependency tree or lockfile state, commands, passing result, and CI matrix dimensions.

Work units

For library PRs, identify direct dependencies and compare overlapping lockfile sections and transitive relationships. Batch PRs only when they update interdependent packages or cannot be evaluated independently without lockfile conflicts. Keep Actions updates independent.

Order library work units from leaf dependencies toward shared or core dependencies. Print the planned order and the reason for each batch before evaluation.

Cleanup and report

Remove only temporary branches and worktrees created by this run. Return the primary checkout to its original branch and preserve unrelated local state.

Report every discovered PR with title, type, evaluated head SHA, verdict, action, and concise notes. Include totals for merged, WARN, FAIL, skipped after prior merges, and not evaluated. For every non-merged PR, include the specific concern or failure and the smallest next step.

Also report:

• baseline commands and result;
• Dependabot configuration gaps and whether a corrective PR was authorized or created;
• external sources used for release, advisory, or pin verification;
• CI matrix dimensions not tested locally; and
• exact GitHub writes performed.

Do not describe an approval, merge, comment, or configuration change as complete until its GitHub state has been read back and verified.