deps-triage

name	deps-triage
description	Triage open dependency and chore PRs — CI state, breaking-change check, safe-to-merge classification with reasoning. The user rules on the list; merging the safe ones follows their OK. Argument: none, or "merge" to pre-request merge of everything classified safe.

Answer "which of the open dependency PRs can be merged?" with a classified list the user can act on in one pass.

1. Collect

Open dependency/chore PRs with their state: gh pr list --json number,title,author,labels,statusCheckRollup,autoMergeRequest,url — filter to bot authors (dependabot, renovate) and dependency/chore-labeled or chore(deps)-titled PRs.

Done when: every open bot/dependency PR is in the working set, not just the first page.

2. Judge each PR

• Version jump — patch / minor / major, from the title
• Reach — dev-only dependency vs runtime/shipped; lockfile-only vs code changes (gh pr diff <N> --stat)
• Breaking changes — the release notes/changelog in the PR body; for a major bump, actually read them
• CI — the check rollup; a red check gets its failure named, not just "red"
• Auto-merge — armed but stalled? Name what it's waiting on (a required check that never ran, a stuck workflow)

3. Classify and present

Three buckets, each PR with a one-line reasoning:

• SAFE — patch/minor, CI green, no breaking notes (dev-deps lean safe; runtime deps need the notes read)
• LOOK — major bump, breaking notes, runtime reach, or anything you couldn't verify
• STUCK — auto-merge armed but not progressing; include the unstick action

Present the table and wait for the user's ruling. With their OK (or the merge argument as the pre-given OK), merge the SAFE bucket per the repo's merge method and report each result.

Done when: every open dependency PR is merged, deliberately left open with a named reason, or handed to the user.