verify-dependabot-prs

星标11

分支14

更新时间2026年7月31日 14:04

Batch, validate, and consolidate open Dependabot pull requests for memory-service. Use when asked to inspect the Dependabot queue, verify dependency PRs efficiently, reproduce dependency-update CI failures, combine compatible dependency PRs, or create a validated consolidated dependency PR.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

来源

chirino

chirino/memory-service

打开 GitHub 仓库查看创作者相关仓库

下载

Verify Dependabot PRs

Use scripts/dependabot_batch.py for discovery, isolated validation, caching, and publication. Keep the user's current worktree untouched.

Workflow

Run discovery from the repository root:

python3 .skills/verify-dependabot-prs/scripts/dependabot_batch.py discover

Inspect every selected PR before executing dependency code:
- Confirm it is authored by Dependabot and targets the default branch.
- Review its manifest and lockfile changes.
- Enforce the 7-day release cooldown for direct and changed transitive versions using authoritative registry or release metadata.
- Defer a PR if any changed version is too new or its publication time cannot be verified.
- Record the checked PR number, exact head SHA, versions, publication dates, and conclusion in a JSON cooldown report. Use this shape:
```
{
  "checkedAt": "2026-07-10T18:00:00Z",
  "prs": {
    "344": {
      "headSha": "full commit SHA",
      "status": "eligible",
      "summary": "All changed versions were published at least 7 days ago."
    }
  }
}
```
Use current CI as evidence and prioritization, not as a substitute for local validation:
- Batch PRs whose verify-generated, test-go, test-java, and test-site jobs are green.
- Isolate CI-red PRs initially so a known failure does not contaminate the green batch.
- Treat fail-fast cancellations as secondary to the first failed job.
- Put PRs with overlapping files or merge conflicts into separate ordered batches.
- A missing CI run may be expected for paths ignored by .github/workflows/ci.yml; report it explicitly.

Dry-run the selected batch:

python3 .skills/verify-dependabot-prs/scripts/dependabot_batch.py run \
  --prs 344 346 347 \
  --cooldown-report /absolute/path/cooldown.json \
  --dry-run

Validate the batch. The runner creates a disposable wt worktree and devcontainer, merges the exact PR heads onto the latest default-branch SHA, and runs these gates sequentially:
- task generate, then require a clean Git worktree.
- task test.
- task test:site.
Never run task test and task test:site concurrently in one worktree. Stop the batch at the first failure, preserve its worktree and logs, and continue investigating from those artifacts.
If a multi-PR batch fails, test smaller halves without --publish. Prioritize PRs whose current CI already points at the failing gate. If both halves pass but the combined batch fails, report a cross-PR interaction and minimize the reproducing set. Always rerun the final surviving combined set.
Publish only the final maximal passing batch:
```
python3 .skills/verify-dependabot-prs/scripts/dependabot_batch.py run \
  --prs 344 346 347 \
  --cooldown-report /absolute/path/cooldown.json \
  --publish
```
Publication pushes the exact validated batch commit to a new chore/dependabot-batch-* branch and opens one draft PR. Batch merge commits must use the caller's normal Git author and committer identity; do not override user.name, user.email, or the corresponding GIT_* environment variables. The PR body records the source PRs and SHAs, their CI states, the cooldown evidence, and all local gates. Do not edit, close, approve, or merge the original Dependabot PRs.

Result handling

Cache results under the repository's common Git directory, keyed by the base SHA, ordered PR head SHAs, and gate definition. Reuse only an exact passing cache entry.
Remove a passing worktree after the batch PR is created unless --keep-passed is set.
Preserve failed worktrees and logs. Nothing is pushed when preparation or validation fails.
Report the batch PR URL and its new CI status. The new batch PR's CI is the final remote integration signal; do not mark it ready or merge it unless the user separately requests that action.

同仓库更多 Skills

同仓库

operationevent-logging

chirino/memory-service

Implement or review Memory Service backend operational logging. Use for REST or gRPC boundaries, provider errors, error wrapping, background workers and task attempts, indexers and maintenance jobs, SSE or gRPC streams, request correlation, and changes under internal/operationevent.

2026-07-1911

prepare-pull-request

chirino/memory-service

Prepare Memory Service changes for pull request submission. Use whenever Codex is asked to create, open, submit, publish, or ready a pull request, or to perform final PR preflight. Require `task generate` before the final PR commit so generated sources and repository-wide formatting are included.

2026-07-1811

testing

chirino/memory-service

Use when writing or debugging tests for memory-service. Covers Cucumber BDD patterns and failure reporting.

2026-07-1611

build-test

chirino/memory-service

Use when you need build, test, or dev commands for memory-service across Go, Java, frontend, or Python modules.

2026-07-1111

enhancement-docs

chirino/memory-service

Use when writing or editing enhancement documents in docs/enhancements/. Provides format, conventions, and numbering guidance.

2026-07-0911

openapi-workflow

chirino/memory-service

Use when making changes to the OpenAPI contract. Workflow for updating spec and regenerating clients.

2026-04-2911

name	verify-dependabot-prs
description	Batch, validate, and consolidate open Dependabot pull requests for memory-service. Use when asked to inspect the Dependabot queue, verify dependency PRs efficiently, reproduce dependency-update CI failures, combine compatible dependency PRs, or create a validated consolidated dependency PR.

Verify Dependabot PRs

Use scripts/dependabot_batch.py for discovery, isolated validation, caching, and publication. Keep the user's current worktree untouched.

Workflow

Run discovery from the repository root:

python3 .skills/verify-dependabot-prs/scripts/dependabot_batch.py discover

Inspect every selected PR before executing dependency code:
- Confirm it is authored by Dependabot and targets the default branch.
- Review its manifest and lockfile changes.
- Enforce the 7-day release cooldown for direct and changed transitive versions using authoritative registry or release metadata.
- Defer a PR if any changed version is too new or its publication time cannot be verified.
- Record the checked PR number, exact head SHA, versions, publication dates, and conclusion in a JSON cooldown report. Use this shape:
```
{
  "checkedAt": "2026-07-10T18:00:00Z",
  "prs": {
    "344": {
      "headSha": "full commit SHA",
      "status": "eligible",
      "summary": "All changed versions were published at least 7 days ago."
    }
  }
}
```
Use current CI as evidence and prioritization, not as a substitute for local validation:
- Batch PRs whose verify-generated, test-go, test-java, and test-site jobs are green.
- Isolate CI-red PRs initially so a known failure does not contaminate the green batch.
- Treat fail-fast cancellations as secondary to the first failed job.
- Put PRs with overlapping files or merge conflicts into separate ordered batches.
- A missing CI run may be expected for paths ignored by .github/workflows/ci.yml; report it explicitly.

Dry-run the selected batch:

python3 .skills/verify-dependabot-prs/scripts/dependabot_batch.py run \
  --prs 344 346 347 \
  --cooldown-report /absolute/path/cooldown.json \
  --dry-run

Validate the batch. The runner creates a disposable wt worktree and devcontainer, merges the exact PR heads onto the latest default-branch SHA, and runs these gates sequentially:
- task generate, then require a clean Git worktree.
- task test.
- task test:site.
Never run task test and task test:site concurrently in one worktree. Stop the batch at the first failure, preserve its worktree and logs, and continue investigating from those artifacts.
If a multi-PR batch fails, test smaller halves without --publish. Prioritize PRs whose current CI already points at the failing gate. If both halves pass but the combined batch fails, report a cross-PR interaction and minimize the reproducing set. Always rerun the final surviving combined set.
Publish only the final maximal passing batch:
```
python3 .skills/verify-dependabot-prs/scripts/dependabot_batch.py run \
  --prs 344 346 347 \
  --cooldown-report /absolute/path/cooldown.json \
  --publish
```
Publication pushes the exact validated batch commit to a new chore/dependabot-batch-* branch and opens one draft PR. Batch merge commits must use the caller's normal Git author and committer identity; do not override user.name, user.email, or the corresponding GIT_* environment variables. The PR body records the source PRs and SHAs, their CI states, the cooldown evidence, and all local gates. Do not edit, close, approve, or merge the original Dependabot PRs.

Result handling

Cache results under the repository's common Git directory, keyed by the base SHA, ordered PR head SHAs, and gate definition. Reuse only an exact passing cache entry.
Remove a passing worktree after the batch PR is created unless --keep-passed is set.
Preserve failed worktrees and logs. Nothing is pushed when preparation or validation fails.
Report the batch PR URL and its new CI status. The new batch PR's CI is the final remote integration signal; do not mark it ready or merge it unless the user separately requests that action.