skills.rest
shoji9x9
shoji9x9COMMUNITY
Explore all skills by this author →
𝕏@shoji9x9GitHub

dependabot-merge

Review and merge Dependabot pull requests via gh CLI with CI and changelog verification.

Updated Jul 24, 2026
Search Tags:#pull request#Dependabot#dependency updates#GitHub CLI#CI verification#merge automation#changelog review
One-click install
npx skills add https://github.com/shoji9x9/portfolio --skill dependabot-merge-shoji9x9
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependabot-merge
Source: https://github.com/shoji9x9/portfolio/tree/main/.agents/skills/dependabot-merge
Command: npx skills add https://github.com/shoji9x9/portfolio --skill dependabot-merge-shoji9x9

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Merging dependency update PRs based only on passing CI is risky, especially for 0.x dependencies where minor updates can contain breaking changes. This Skill standardizes the review-and-merge workflow for Dependabot PRs so every merge decision is verified against changelogs and recorded as a PR comment. ## Core Features & Use Cases - Single PR review and merge: Verify the author is Dependabot, confirm CI success, assess merge impact from release notes and changelogs, record the rationale as a PR comment, then merge with a configurable method (squash, merge, or rebase). - Batch processing with --all: Enumerate all open Dependabot PRs with pagination-safe listing, re-fetch each PR's latest state before processing, and loop until no new PRs appear, accounting for Dependabot's rebase and force-push behavior. - Robust CI and behind-branch handling: Detect false-positive CI completion after rebases, fall back from @dependabot rebase to @dependabot recreate on refusal, and switch to successor PRs when one is superseded. - Use Case: You return to a repository with eight open Dependabot PRs. Run the skill with --all to have each PR's CI status and changelog impact checked one by one, with safe updates merged and risky ones documented with the reason and required fix. ## Quick Start Ask the AI to review and merge all open Dependabot pull requests in the current repository, checking CI results and changelogs before each merge.

Frequently Asked Questions about dependabot-merge

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I merge all open Dependabot PRs at once?▼

Run the skill with --all or no argument to process every open Dependabot PR sequentially. Each PR's state is re-fetched before processing, and the loop repeats until no new PRs appear, since merging one PR often triggers rebases of the rest.

How to safely merge dependency updates for 0.x packages?▼

For 0.x dependencies, minor updates can include breaking changes, so the skill requires checking the changelog and release notes for API changes, removals, or behavior changes before merging. If the impact cannot be determined, it stops and asks the user instead of merging.

Why does gh pr checks --watch exit 0 right after a Dependabot rebase?▼

After a rebase or force-push, required checks may not be registered yet, so --watch completes on only the currently registered checks and exits 0 prematurely. The skill polls mergeStateStatus for CLEAN or UNSTABLE, or uses gh pr checks --required, before treating CI as complete.

What happens when a Dependabot PR is superseded or closed during processing?▼

The skill detects closure via the PR state and comments like Superseded by #N, stops tracking the closed PR, and re-fetches the open Dependabot PR list to find the successor. Already-completed changelog and impact analysis is reused for the successor PR.

Can I choose squash, merge, or rebase as the merge method?▼

Yes, the merge method is configured once in .config/skills/shoji9x9/skills.yml under skills.dependabot-merge.merge_method, defaulting to squash. If the configured method is not allowed by the repository, the skill asks you to pick a permitted one.

What tools are required to run this Dependabot merge workflow?▼

Only the GitHub CLI (gh, including gh api) and a bash-compatible shell are required; no Node.js, pnpm, or Python runtimes are needed. On Windows, use WSL or Git Bash since the command examples assume bash.

Related Skills

Explore More Software Engineering Skills→
chainloop-devchainloop-dev
583

dependabot-pr-automation

Reviews, risk-assesses, approves, and merges open Dependabot pull requests on GitHub.

Official
Intermediate
NimbusPoweredNimbusPowered
3

version-check

Analyze git commits to recommend semantic version bumps for Nimbus releases.

Official
Intermediate
PaulKinlanPaulKinlan
2

dependency_audit

Audit npm and pip dependencies for vulnerabilities and license compliance.

Community
Intermediate
MinBZKMinBZK
20

dependabot

Process open Dependabot pull requests oldest-first with GitHub CLI.

Official
Advanced