菜单
Scan all repos in `repos/` for open Dependabot PRs, triage new ones, and stage patrol-style comments for review. Use when asked to triage, scan, or review open Dependabot PRs across multiple repos. Does not post to GitHub — staged comments are reviewed conversationally before posting.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Query and manage Shipwright agents via the admin API — cron jobs, env vars, tool permissions, API tokens, and plugins. Use to configure the running agent, manage its schedules, inspect another agent's config, or provision a new agent.
Orchestrates the full test-readiness pipeline (phases 1–5), once per qualifying repo under repos/, each in its own worktree + branch. Runs test-inventory → test-design → test-migration → test-roadmap → test-fix in sequence per repo, starting from the first stale artifact. Invoked by the `shipwright-test-readiness` cron on a daily schedule; exits early for a repo when all of its phase artifacts are fresh.
Scan Sentry for new/regressed unresolved issues, dynamically map them to repos. Report only — no code changes.
Cross-cutting contract for the test-readiness pipeline. Specifies the GitHub repository configuration that makes "tests pass" structurally meaningful instead of advisory — branch protection requiring CI to pass, required secrets, environments, deploy hooks, and PR templates. Referenced by `test-design` (Phase 2 emits the repo-config plan) and `test-roadmap` (Phase 4 auto-pairs workflow tasks with branch-protection tasks). Without these, the verification commands in each task body are honor-system; with them, the workflow is the gate.
Phase 4 of the test-readiness pipeline. Synthesizes the three prior artifacts (inventory, system design, migration) into a single executable roadmap `test-readiness-plan.md` with five sequenced milestones and an agent-executable task list. Includes mandatory sections on where we are now, where we want to be, the gap, the speed delta, and open risks. Output is suitable for handoff to an engineer or to `shipwright /dev-task`. Invoke when the `/test-roadmap` command runs.
Query and update the Shipwright task store — pick the next ready task, mark status transitions, and append new tasks. Use whenever you need to read from or write to the task queue. Calls the task store HTTP API directly via curl.
| name | triage-dependabot-prs |
| description | Scan all repos in `repos/` for open Dependabot PRs, triage new ones, and stage patrol-style comments for review. Use when asked to triage, scan, or review open Dependabot PRs across multiple repos. Does not post to GitHub — staged comments are reviewed conversationally before posting. |
Scan every repo in repos/ for open Dependabot PRs, triage new ones, and stage comments for review.
Read state/dependabot-reviews.json. Create [] if missing.
For each entry with status of staged or posted:
gh pr view {pr} --repo {org}/{repo} --json state -q '.state'
MERGED → set status: "merged", mergedAt: <now>CLOSED → set status: "closed"For each directory in repos/:
# Get owner/repo for this directory
git -C repos/{dirname} remote get-url origin
# Parse owner/repo from the URL (strip .git suffix, handle both https and ssh formats)
# List open Dependabot PRs
gh pr list --repo {owner}/{repo} --author "app/dependabot" --state open --json number,title,headRefName
For each open PR not already present in state with a non-terminal status (pending, staged, posted):
{ pr, repo, org, title, branch, status: "pending", firstSeen: <now>, lastTriagedAt: null, recommendation: null, stagedFile: null, postedAt: null, mergedAt: null }For each entry with status: "pending":
Invoke the triage-dependabot-pr skill with {pr} --repo {org}/{repo}.
The skill writes the staged comment file and updates the state entry to staged. Collect the recommendation from the skill output.
Process serially — merging one PR can affect others.
Write the updated state/dependabot-reviews.json.
Output a summary table of all active entries (skip merged and closed):
## Dependabot Triage Summary
| Repo | PR | Title | Recommendation | Status |
|------|-----|-------|---------------|--------|
| my-repo | #42 | Bump axios 1.6→1.7 | ✅ merge | staged |
| my-repo | #41 | Bump webpack 4→5 | 🛑 hold | staged |
New this run: N staged
Already staged: M
Merged/closed: P
If nothing to do: "No pending Dependabot PRs. All up to date."
Staged reviews are ready for conversational walkthrough — run through them with the agent to review and post.
gh pr comment <number> --body "@dependabot rebase" --repo {owner}/{repo}).gh CLI for all GitHub interactions. Respect the current GH_TOKEN / gh auth context.