About this template
Forty Dependabot PRs. Three of them actually matter.
They all look identical in the list, so the majors get closed — and regenerate next schedule — while the routine ones get rubber-stamped without anyone opening a changelog.
The noise is the vulnerability.
What it does
Points at a repo, reads every open Dependabot PR, and sorts them into three buckets you can argue with:
- ROUTINE — patch or minor, no breaking-change entry, CI actually read. Recommendation is batch these, not merge these unread.
- NEEDS-MIGRATION — semver-major, or a changelog that says BREAKING /
removed / renamed. Recommendation is close plus an
ignorerule, because a closed major without one is back next Monday. - SECURITY — advisory attached. Never batched, never ignored, escalated regardless of semver.
A PR it cannot classify goes to NEEDS-MIGRATION. Unknown is not safe.
What you get out
A report at ~/dep-triage/reports/<repo>-<date>.md: counts per bucket, a table
of package / version delta / bucket / why, the security list pulled to the top
unbatched, and a proposed .github/dependabot.yml diff — groups for the
routine set, ignore entries for every major it wants closed.
The report is the snapshot. The config diff is the thing that stops the noise coming back.
The guard is a file, not a promise
~/dep-triage/policy/TRIAGE-POLICY.md carries a literal NEVER_AUTOMERGE
block and the bucket definitions, and the skill reads it before every run. Ask
it to merge and it refuses and points there.
That file is also where you disagree with it. Think a major is routine for your stack? Edit the policy, not the prompt.
What you supply
gh auth loginwith your own token — repo read plus PR write. It never merges, so it never needs more.- Your own Claude Code login.
gh ships in the template at ~/.local/bin/gh; add it to PATH if your shell
does not already.
Where this stops
It classifies, reports, and drafts config. It does not merge, approve, or push
to a protected branch. It will close PRs and open a dependabot.yml PR when you
ask it to, and not before.
Verified on build: the skill, the working tree, the NEVER_AUTOMERGE guard and
a working gh are present on a fresh fork, and no token shape exists anywhere
in the snapshot. Running it against your own backlog is yours to do.