# Dependabot PR Triage

> Sorts a Dependabot backlog into routine, needs-migration and security — then drafts the groups and ignore rules that stop it regenerating. Never merges.

- Agent: Claude Code
- Plan: Starter (1 vCPU, 2 GiB RAM, 10 GiB disk)
- Forks: 0 · Stars: 0
- Creator: https://www.jurniti.com/creator-ca0ff2
- Tags: ci, claude-code, dependabot, devops, github, security, software-factory
- Requires config (you provide): ANTHROPIC_API_KEY
- Skills: dependabot-triage

**To fork:** open https://www.jurniti.com/templates/dependabot-pr-triage and use the Fork action — it starts a Stripe Checkout for a new VM seeded with this template's persist disk (same flat plan price, no fork fee).

## README

# Forty Dependabot PRs. Three of them actually matter.

They all look identical in the list, so the majors get closed — and regenerate
next schedule — while the routine ones get rubber-stamped without anyone opening
a changelog.

The noise is the vulnerability.

## What it does

Points at a repo, reads every open Dependabot PR, and sorts them into three
buckets you can argue with:

- **ROUTINE** — patch or minor, no breaking-change entry, CI actually read.
  Recommendation is *batch these*, not *merge these unread*.
- **NEEDS-MIGRATION** — semver-major, or a changelog that says BREAKING /
  removed / renamed. Recommendation is close **plus an `ignore` rule**, because
  a closed major without one is back next Monday.
- **SECURITY** — advisory attached. Never batched, never ignored, escalated
  regardless of semver.

A PR it cannot classify goes to NEEDS-MIGRATION. Unknown is not safe.

## What you get out

A report at `~/dep-triage/reports/<repo>-<date>.md`: counts per bucket, a table
of package / version delta / bucket / why, the security list pulled to the top
unbatched, and a proposed `.github/dependabot.yml` diff — `groups` for the
routine set, `ignore` entries for every major it wants closed.

The report is the snapshot. The config diff is the thing that stops the noise
coming back.

## The guard is a file, not a promise

`~/dep-triage/policy/TRIAGE-POLICY.md` carries a literal `NEVER_AUTOMERGE`
block and the bucket definitions, and the skill reads it before every run. Ask
it to merge and it refuses and points there.

That file is also where you disagree with it. Think a major is routine for your
stack? Edit the policy, not the prompt.

## What you supply

- `gh auth login` with your own token — repo read plus PR write. It never merges,
  so it never needs more.
- Your own Claude Code login.

`gh` ships in the template at `~/.local/bin/gh`; add it to PATH if your shell
does not already.

## Where this stops

It classifies, reports, and drafts config. It does not merge, approve, or push
to a protected branch. It will close PRs and open a `dependabot.yml` PR when you
ask it to, and not before.

Verified on build: the skill, the working tree, the `NEVER_AUTOMERGE` guard and
a working `gh` are present on a fresh fork, and no token shape exists anywhere
in the snapshot. Running it against your own backlog is yours to do.