dependabot-merge

Files (1)

• SKILL.md

SKILL.md (first lines)

# Dependabot Merge

Merge safe dependency updates. Stop and report the unsafe ones. Never merge a
pull request that you did not check in this run.

Use the `gh-cli` skill for queries, required-check watching, and failure logs.
In a batch, process other ready pull requests instead of waiting on one.

The checks are the same for every dependency bot. Only the discovery query and
the place that holds the update metadata change. See "Which bots".

## Scope

The scope is fixed: the **`goreleaser` organization** and the **`caarlos0`
user**. Do not ask which owners to process. Start the run immediately.

**Never widen the scope on your own.** The user belongs to many organizations
that they do not maintain. Merging there affects other people. Process another
owner only when the user names it in the argument, and process only that owner
in addition to the two above.

## Ledger

Keep a ledger, so that a second run does not check the same pull request again.
Create it once per run with the `sql` tool:

```sql
CREATE TABLE IF NOT EXISTS dependabot_prs (
  url TEXT PRIMARY KEY,
  repo TEXT, number INTEGER, title TEXT,
  bot TEXT,       -- dependabot | renovate | pre-commit-ci | ...
  state TEXT,     -- pending | merged | skipped | blocked | failed
  reason TEXT,
  checked_at TEXT
);
```

Write a row with `state='pending'` when you find a pull request. Update the row
immediately after each decision. Read the ledger before each step and process
only `pending` rows. Report the terminal rows again at the end, but do not
check them again.

## Which bots

Handle every dependency bot, not only Dependabot. They differ in three ways:
the author login, where the update metadata lives, and the branch prefix.

| Bot         | Author login        | Metadata lives in            | Branch prefix |
| ----------- | ------------------- | ---------------------------- | ------------- |
| Dependabot  | `dependabot[bot]`   | `updated-dependencies:` block in the commit body | `dependabot/` |
| Renovate    | `renovate[bot]`     | a table in the **pull request body** | `renovate/`   |
| Mend/self-hosted Renovate | a custom account, often `renovate-bot` | same as Renovate | `renovate/` |
| pre-commit.ci | `pre-commit-ci[bot]` | the pull request body; edits `.pre-commit-config.yaml` | `pre-commit-ci-update-config` |

**Renovate has no commit metadata block.** Its versions live in a markdown
table in the pull request body, next to a `<!--renovate-debug:...-->` comment:

```bash
gh pr view NUMBER -R REPO --json body -q .body
```

That table is generated at the same time as the diff, but it is still a
summary. The rule below does not change: **read the diff.**

Two Renovate-only things to watch:

- A pull request that edits `renovate.json`, `.github/renovate.json` or
  `.renovate.json` is a **configuration** change, not a dependency bump. It is
  outside the manifest/lockfile/workflow allowlist, so it is `blocked` for a
  human.
- Renovate can run `postUpgradeTasks` and custom managers, so it can touch
  files a version bump does not explain. Treat any such file as a block.

## Collect

`gh search prs` takes only one `--author`, and a second flag silently replaces
the first. Use the search API instead, where a repeated `author:` qualifier
means OR.

**Run one query for each owner.** `org:` covers an organization and `user:`
covers a personal account; they are not interchangeable, and a separate query
keeps the 100-item page limit and any error for each owner separate. These are
the discovery commands for this skill — run them as-is:

```bash
BOTS='is:pr is:open draft:false author:app/dependabot author:app/renovate author:app/pre-commit-ci'

gh api -X GET search/issues -f per_page=100 \
  -f q="org:goreleaser $BOTS" \
  --jq '.items[] | "\(.user.login)\t\(.html_url)\t\(.title)"'

gh api -X GET search/issues -f per_page=100 \
  -f q="user:caarlos0 $BOTS" \
  --jq '.items[] | "\(.user.login)\t\(.html_url)\t\(.title)"'
```

Collect both into `urls.txt` for the parallel fetch below:

```bash
for owner in org:goreleaser user:caarlos0; do
  gh api -X GET search/issues -f per_page=100 \
    -f q="$owner $BOTS" --jq '.items[].html_url'
done > urls.txt
```

Each query returns at most 100 items for each page. Compare the line count
with `total_count` and paginate with `-f page=2` when it is larger.

Keep the `q` value on one line. A newline inside it makes the search API reject
the whole query with `422 Validation Failed`.

Add a self-hosted bot with a plain `author:renovate-bot` (no `app/` prefix,
because it is a normal account).

**Do not trust `is_bot`.** In `gh search prs` output, `dependabot[bot]` reports
`is_bot: false`. Match on the login instead.

Insert the results into the ledger, recording which bot opened each one.

From caarlos0/dotfiles, MIT.

More from caarlos0/dotfiles