skills.rest
tomada1114
tomada1114COMMUNITY
Explore all skills by this author →
Website𝕏@muscle_codingGitHub

merge-dependabot

Triages, verifies, and merges open Dependabot and Renovate dependency pull requests.

Updated Sep 15, 2026
Search Tags:#pull requests#pnpm#dependency updates#github cli#renovate#dependabot#ci triage
One-click install
npx skills add https://github.com/tomada1114/quick-reply-drill --skill merge-dependabot-tomada1114
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: merge-dependabot
Source: https://github.com/tomada1114/quick-reply-drill/tree/main/.agents/skills/merge-dependabot
Command: npx skills add https://github.com/tomada1114/quick-reply-drill --skill merge-dependabot-tomada1114

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Open Dependabot and Renovate pull requests pile up, contest the same lockfile, and carry real supply-chain risk, so landing them safely requires tedious manual triage of CI state, semver level, and diffs for every single PR. ## Core Features & Use Cases - Read-only PR survey: A script lists every open bot PR with ecosystem, semver level, check rollup, merge state, touched files, and which files are contested by multiple PRs. - Risk-based landing modes: Merges clean PRs individually or builds one combined integration branch that regenerates pnpm-lock.yaml, then closes superseded originals only after the combined PR lands. - Security and failure triage: A checklist covers SHA-pinning, major-bump release notes, and 0.x minors, plus a catalog of nine CI failure modes (peer conflicts, lockfile drift, cooldown rejections, build regressions) with the correct response to each. - Use Case: You return from vacation to twelve open Dependabot PRs, several fighting over pnpm-lock.yaml. Run the survey, present one triage plan for approval, then let the skill merge the clean Actions PRs and combine the npm ones into a single verified PR. ## Quick Start Ask the assistant to survey all open Dependabot and Renovate pull requests in this repository and propose a merge plan for approval.

Frequently Asked Questions about merge-dependabot

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I merge multiple Dependabot PRs at once?▼

Survey all open bot PRs, then build one combined branch that merges each participating branch and regenerates pnpm-lock.yaml with pnpm install --lockfile-only. After CI passes on the combined PR, merge it and close the superseded originals with a pointer comment.

How do I decide between merging Dependabot PRs individually or combining them?▼

Merge individually only when there are three or fewer eligible PRs, no contested files, and each is CLEAN with passing checks. Combine when more than three PRs exist, two or more touch the same file, or npm PRs need lockfile regeneration.

Why does a Dependabot PR fail at pnpm install with a peer dependency error?▼

The repository sets strictPeerDependencies: true, so an unmet peer range is a hard failure. A common case is typescript-eslint capping the typescript version; hold that PR because raising the ceiling requires a coordinated upgrade of both packages.

Can I hand-edit pnpm-lock.yaml to resolve a merge conflict between dependency PRs?▼

No. Lockfile conflicts must be resolved by running pnpm install --lockfile-only to regenerate the file, never by manual editing. Hand-edited lockfiles risk inconsistency with package.json and bypass supply-chain verification.

What security checks should I run before approving a dependency bump PR?▼

Confirm GitHub Actions remain SHA-pinned with version comments, read release notes for major bumps and 0.x minors, verify the dependency review check passed, and ensure the bump does not relax pnpm-workspace.yaml supply-chain settings or add allowBuilds entries.

What happens if a Dependabot PR's checks never report or stay pending?▼

A missing or pending check is not a passing check. Re-run the workflow with gh run rerun, and never merge a PR whose checks never actually ran, since the classifier treats unknown conclusions as failing.

Related Skills

Explore More Software Engineering Skills→
virajpvirajp
1

pnpm

Configure pnpm workspace and npm settings for secure JavaScript monorepos.

Community
Intermediate
s3nex-coms3nex-com

pr-merge-orchestrator

Coordinate pull request lifecycle from review through merge with mandatory gates.

Community
Advanced
langfuselangfuse
34.0k

pnpm-upgrade-package

Upgrade pnpm workspace dependencies with release-age checks and lockfile verification.

Official
Advanced
ceratops-codeceratops-code

ceratops-gh-repo-dependency-update

Automate end-to-end GitHub dependency update workflows with automated checks and safe merges.

Official
Advanced