dependabot-review
Review and manage Dependabot PRs. Categorizes by risk, checks CI status, auto-merges safe updates, and reports issues. Use when the user says "review dependabot", "merge dependabot", "dependabot PRs", or "update dependencies".
Target: AI & workflow automation. Automatically collected · unverified.
Excerpt from the author’s documentation
Extracted from a fixed version of SKILL.md in its original language. This is the author’s documentation; installation, compatibility and runtime results have not been verified by this site.
Read the original English text
Topics in the source
- Dependabot PR Review
- Workflow
- Step 1: Discovery
- Step 2: Classification
- Step 3: CI Check
- Step 4: Merge Safe PRs
- Step 5: Report
- Guardrails
You are a dependency management specialist. Your job is to review all open Dependabot PRs, assess risk, and take action. List all open Dependabot PRs: If no PRs are found, inform the user and stop. For each PR, classify it into a risk tier based on the branch name and title: | Tier | Criteria | Action | |------|----------|--------| | Safe | GitHub Actions updates (dependabot/githubactions/), patch bumps (1.2.3 -> 1.2.4) | Auto-merge | | Low Risk | Minor bumps (1.2.0 -> 1.3.0) for well-known libraries | Auto-merge after CI check | | Review Required | Major bumps (1.x -> 2.x), unknown libraries, security-tagged PRs | Report to user | To determine bump type, parse the PR title. Dependabot titles follow patterns like: Bump X from 1.2.3 to 1.2.4 (patch) Bump X from 1.2.0 to 1.3.0 (minor) Bump X from 1.0.0 to 2.0.0 (major) For each PR you plan to merge, check CI status: If all checks pass: proceed with merge If checks are pending: wait up to 2 minutes (poll every 30s). If still pending, skip and report as "CI pending" If any check fails: skip and report to user For PRs classified as Safe or Low Risk with passing CI: Important rules: Never force-merge Never merge PRs with failing CI Never
This is an excerpt. Refer to the complete source and its current requirements.
- Source repository
- davila7/claude-code-templates
- Source file
- cli-tool/components/skills/workflow-automation/dependabot-review/SKILL.md
- Fixed revision
- 21be197f100a12b8d0dd9a211cc244c8179f84d3
Sources and evidence
This record was collected automatically. Its documentation, suitability and runtime behavior have not been manually verified.
Author: davila7/claude-code-templates · original repository metadata. Documentation review: Not reviewed. Last source check: 2026-11-09T15:01:40.916Z.
Categories are inferred from names, descriptions and paths. They do not establish compatibility.
License and attribution
MIT. Third-party content and copyright remain with their authors. Refer to the original license and terms.
Original license ↗Synchronization, copying and user-reported success do not mark a resource as runtime-tested.
Limitations and notes
- Collecting metadata does not mean this site has installed, adapted, runtime-tested or security-reviewed the resource.