---
name: dependabot-triage
description: >
  Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor /
  major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with
  a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling
  up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe
  ones", or at the start of a maintenance window.
license: MIT
allowed-tools: Bash, Read, Write
compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires git and gh (GitHub CLI) authenticated.
metadata:
  targets: [_source-only]
  author: Oleg Koval
  tags:
    - dependabot
    - renovate
    - dependencies
    - security
    - automation
    - triage
    - github
source: weekly-pattern-learner
source_reason: "obsidian-pr-sync explicitly filters out dependabot/renovate PRs: the user handles them separately, but no skill existed to batch-triage them"
source_date: "2026-07-31"
---

> 🤖 *Auto-generated by **weekly-pattern-learner** · obsidian-pr-sync explicitly filters out dependabot/renovate PRs: the user handles them separately, but no skill existed to batch-triage them*

# Dependabot Triage

Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe,
flag what needs a human decision, and report what was done.

## Inputs

- **Repository** (optional): default to the current repo.
- **Auto-merge policy** (optional, default: `patch-only`): `none`, `patch-only`, or `patch-and-minor`.
- **Require CI** (optional, default: on): only merge PRs whose checks are green.

## Step 1: Fetch all open dependency PRs

```bash
# Dependabot PRs
gh pr list --state open --label "dependencies" \
  --json number,title,author,labels,headRefName,url,isDraft \
  --jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'

# Also catch Renovate PRs not labelled "dependencies"
gh pr list --state open \
  --json number,title,author,labels,headRefName,url,isDraft \
  --jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'
```

Merge both result sets, deduplicate by number, skip drafts.

## Step 2: Classify each PR

Parse the PR title to extract package name and version change.

Dependabot title format: `Bump <package> from <old> to <new>`
Renovate title format: `Update dependency <package> to v<new>` or `chore(deps): update <package>`

For each PR:

```bash
gh pr view <NUMBER> --json title,body,labels,reviews \
  --jq '{title, body: (.body | .[0:500]), labels: [.labels[].name], reviews: [.reviews[].state]}'
```

Classify:

| Tier | Condition | Default action |
|------|-----------|----------------|
| **patch** | semver patch bump (`X.Y.Z → X.Y.Z+1`), no security label | auto-approve and merge (if CI green) |
| **minor** | semver minor bump (`X.Y.Z → X.Y+1.0`), no security label | approve and merge when `patch-and-minor` policy |
| **major** | semver major bump (`X.Y.Z → X+1.0.0`) | flag for human: summarize breaking changes |
| **security** | has `security` label, or title contains "CVE" or "vulnerability" | escalate: approve if CI green AND patch/minor; human if major |

When in doubt about the bump type (e.g. non-semver packages), treat as `minor`.

## Step 3: Check CI for merge candidates

For each PR classified as auto-approvable:

```bash
gh pr checks <NUMBER> --json name,state,conclusion \
  --jq '[.[] | select(.conclusion != "success" and .conclusion != "skipped")] | length'
```

If CI is still running, wait up to 10 minutes (polling every 30s). If CI fails, demote
to `blocked`: do not merge a PR with failing checks regardless of policy.

If CI is disabled for dependency PRs in this repo (no checks at all), note it and proceed
only when the user has passed `--skip-ci-check` explicitly.

## Step 4: Approve and merge safe PRs

For each auto-approvable PR with green CI:

```bash
# Approve
gh pr review <NUMBER> --approve --body "Auto-approved by dependabot-triage: patch bump, CI green."

# Merge (squash is the default; use the repo's configured merge strategy if known)
gh pr merge <NUMBER> --squash --delete-branch \
  --subject "$(gh pr view <NUMBER> --json title --jq .title)"
```

If the merge fails (conflict, branch protection, etc.), fall back to `blocked` and note it.

## Step 5: Comment on flagged PRs

For each `major` or `blocked` PR, post one comment summarizing why it needs a human:

```bash
gh pr comment <NUMBER> --body "**dependabot-triage:** This is a major version bump. \
Review the changelog before merging: $(gh pr view <NUMBER> --json body --jq '.body | split("\n") | map(select(test("changelog|release|BREAKING"; "i"))) | .[0]').

No action was taken."
```

## Step 6: Report

Print a digest, then stop. Do not merge anything not listed as approved in this report.

```
Dependabot triage complete.
  Merged (patch, CI green):   7 PRs  →  lodash 4.17.20→4.17.21, eslint 8.56.0→8.57.0, ...
  Merged (security, CI green): 1 PR  →  axios 1.6.2→1.7.9 (CVE-2024-39338)
  Flagged for human review:    2 PRs →  next.js 14→15 (major), @types/node 20→22 (major)
  Blocked (CI failing):        1 PR  →  typescript 5.4→5.5 (lint errors)
  Skipped (draft):             1 PR

  Open a flagged PR and run /pr-to-green after reviewing the changelog.
```

## Safety guardrails

- Never merge a PR whose author is not `dependabot[bot]` or `renovate[bot]`, even if found by the label query.
- Never merge a major bump automatically, even if `patch-and-minor` policy is set.
- Never approve a PR if `gh pr checks` shows any failure: a quiet pass is not the same as no checks.
- Always post a comment on flagged PRs so the record is visible in the thread.

## Chaining

| Before this skill | After this skill |
|---|---|
| morning routine / maintenance window | `olko:pr-to-green` on flagged PRs after human review |
| `olko:obsidian-pr-sync` (which filters these out) | back to obsidian-pr-sync for remaining human PRs |