Menu
Approve and merge safe Dependabot PRs.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.
Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.
Teach the user a new skill or concept, within this workspace.
Creates Jira-linked pull requests from completed code changes. Use when asked to "create a PR", "open a PR", "prepare a PR", "make a pull request", or "create Jira PR". Ensures repository history and pull request metadata follow project conventions.
Reference for writing and editing skills well — the vocabulary and principles that make a skill predictable.
| name | process-dependabot-prs |
| disable-model-invocation | true |
| description | Approve and merge safe Dependabot PRs. |
Wrangle Dependabot PRs into safe bump decisions.
safe bump means dependency update can be approved without user handoff because version class and evidence satisfy explicit gates.
Checks decide merge readiness, not approval readiness.
Completion criterion: every open Dependabot PR in current GitHub review-requested inbox has been listed once.
Use review-requested:@me as primary source.
Filter to author app/dependabot.
Do not use GitHub assignee as ownership signal.
If review-requested search misses expected team requests, report that limitation instead of guessing team list.
gh search prs --state open --author app/dependabot --review-requested @me --limit 1000 --json number,title,url,repository,author
Completion criterion: each candidate PR has dependency list, old version, new version, current review decision, merge state, and check rollup.
gh pr view <number> --repo <owner/repo> --json title,body,headRefName,baseRefName,reviewDecision,mergeStateStatus,statusCheckRollup,reviews,url
Completion criterion: every dependency in every candidate PR has one class: patch, minor, major, or handoff.
SemVer patch and minor are safe candidates only when current major is 1 or greater.
Any 0.x bump is handoff.
Any non-SemVer, calendar version, missing version, unknown version, or ambiguous version is handoff.
For multi-dependency PRs, aggregate by strictest result.
If any dependency is handoff, PR is handoff.
If any dependency is major, PR follows major-review path.
Only all-patch/all-minor PRs can skip changelog research.
Completion criterion: every all-patch/all-minor safe bump has been approved unless already approved by someone else. Do not add custom approval body for minor or patch bumps unless GitHub requires body. Failed, pending, missing, or unknown checks do not block approval. If PR is already approved by someone else, do not merge automatically; hand off before merge.
gh pr review <number> --repo <owner/repo> --approve
Completion criterion: every major PR has one outcome: approved with evidence comment, or handed off. Fetch authoritative changelog, release notes, package maintainer text, GitHub releases, package registry page, or repository changelog from Dependabot PR links. Approve only when authoritative text explicitly says no breaking changes, no migration required, or fully backward compatible. Dependabot generated summaries, compatibility score, or agent inference are not enough. Failed, pending, missing, or unknown checks do not block approval when evidence gate passes. Approval comment must state evidence tersely.
gh pr review <number> --repo <owner/repo> --approve --body "Approved: major bump; upstream release notes explicitly state no breaking changes."
If breaking changes, migration steps, removed APIs, compatibility uncertainty, or no explicit evidence exists, hand off with evidence summary.
Completion criterion: every approved-by-this-run PR is either merged, skipped because checks or merge state block it, or handed off because merge method is ambiguous. Merge only PRs approved by this skill in current run. Do not merge PRs approved before this run by another reviewer; hand off. Every visible check/status must be passing, skipped, or neutral. Pending, failing, cancelled, missing, or unknown checks block merge. When checks fail, collect failed check names and URLs for final report. Do not wait for pending checks. Prefer squash merge if repository allows it. If squash is blocked by repository policy, use enforced allowed method, preferring rebase then merge. Do not bypass branch protection, force merge, admin-merge, or resolve conflicts.
gh pr merge <number> --repo <owner/repo> --squash --delete-branch
Fallback only when squash is disallowed by repository policy:
gh pr merge <number> --repo <owner/repo> --rebase --delete-branch
Last resort only when repository policy enforces merge commits:
gh pr merge <number> --repo <owner/repo> --merge --delete-branch
Completion criterion: final response lists every candidate PR under one outcome: approved, merged, skipped, or handoff. For each PR, include direct PR URL. For each skipped PR, include reason. For each PR with failed checks, include failed check names and URLs. For each handoff, include exact unresolved decision and evidence found.
Do not approve handoff bump classes.
Do not approve major bumps without authoritative explicit no-breaking-change evidence.
Do not merge unapproved PRs.
Do not merge PRs not approved during current skill run.
Do not merge with pending, failing, missing, cancelled, or unknown checks.
Do not let failed checks block approval of safe bump; they only block merge.
Do not edit dependency files, resolve conflicts, rerun CI, or push commits unless user explicitly asks.