| name | safely-merge-dependabots |
| user-invokable | true |
| argument-hint | [PR numbers] [--dry-run] [--timeout <duration>] |
| description | This skill should be used when the user asks to "merge dependabot PRs", "safely merge dependabots", "auto-merge safe dependency updates", "process dependabot PRs", or wants to autonomously analyze and merge Dependabot PRs with comprehensive safety checks. |
Safely Merge Dependabots
Autonomously discover, analyze, and safely merge Dependabot PRs. Uses multi-layered analysis to detect breaking changes, runs the full test suite, and only merges patch/minor updates that pass all safety checks.
Arguments
- PR numbers (optional): Space-separated PR numbers to process. If omitted, discover all open Dependabot PRs.
- --dry-run (optional): Analyze only, do not merge anything. Shows what would be merged.
- --timeout
<duration> (optional): Override test timeout (default: 10m). Format: 5m, 10m, 20m, 30m.
Procedure
Invoke the dependabot-orchestrator agent to coordinate specialized worker agents:
- Discover PRs: Find all open Dependabot PRs (or use specified PR numbers), detect merge conflicts and Dependabot retry instructions
- Follow Dependabot Instructions: Comment
@dependabot rebase, @dependabot recreate, etc. when Dependabot has left retry instructions on a PR
- Analyze Each PR: Dispatch worker agents for comprehensive analysis
- pr-analyzer: Semver classification, breaking change detection, dependency conflicts
- breaking-change-investigator (when MAJOR): Search codebase for actual usage of affected APIs
- test-runner: Test suite execution in isolated worktree
- dependabot-security-checker: CVE verification (when applicable)
- Make Decisions: Auto-merge safe updates, fix trivial breaking changes, skip truly risky ones
- Poll Pending Rebases: Re-check PRs that were rebasing, run full analysis when ready
- Report Results: Detailed summary with merge/skip/rebase counts and reasoning
Safety Policy
Auto-merge when ALL conditions met:
- PATCH or MINOR version update
- All tests pass
- No breaking changes detected
- No dependency conflicts
- Security fixes verified (if applicable)
Investigate before skipping (MAJOR / breaking changes):
- Fetch changelog and identify specific breaking changes
- Search codebase for actual usage of affected APIs
- If codebase is NOT impacted: proceed to test and merge
- If impacted but trivially fixable: make changes in PR branch, test, merge
- If impacted and non-trivial: skip with detailed impact report
Dependabot retry instructions:
- Detect Dependabot comments suggesting
@dependabot rebase, @dependabot recreate, etc.
- Follow the suggested command by commenting on the PR
rebase: poll until complete, then run full analysis pipeline
recreate: PR will be closed and reopened; report as "recreated, re-run to process"
- Also comment
@dependabot rebase on PRs with merge conflicts (even without explicit instructions)
Pending rebase:
- Poll until rebase completes (up to 5 minutes per PR)
- Re-run full analysis pipeline after rebase
- If rebase times out: skip with note to retry later
Always skip (require manual review):
- Non-trivial breaking changes that affect the codebase
- Test failures
- Dependency conflicts
- Missing critical context
Architecture
- Orchestrator (Haiku): Lightweight coordination
- Worker Agents: Specialized models per task (Sonnet for analysis, Haiku for API calls)
- Each PR analyzed sequentially for safety
- All decisions logged with detailed reasoning
- Worker failures result in skip (safe default)