Dependency PR Solver

When To Use

Use for an approved batch pass over open Dependabot PRs where the agent may mutate branches, post comments, create changesets, validate, and merge high-confidence updates.

Trigger phrases:

• "process all Dependabot PRs"
• "clear the dependency backlog"
• "batch-process dependency PRs"
• "batch-merge safe Dependabot updates"

Hard Gates

• Read .github/instructions/dependabot-pr.instructions.md before processing any PR.
• Ask for explicit user confirmation before starting the batch and before expanding scope.
• Process only PRs authored by app/dependabot unless the user overrides with a specific PR.
• Rebase onto the PR base branch; never merge the base branch into a Dependabot branch.
• Do not merge major bumps, failing validation, low-confidence updates, or PRs needing manual code changes.
• Always post research and verdict comments before merging.

Inputs

• Repository owner/name, inferred from workspace when possible.
• PR scope: all open Dependabot PRs or an include/exclude list.
• Mode: normal, --review-only, or --merge-medium with explicit user approval.

Workflow

1. List candidates:

gh pr list --author "app/dependabot" --state open --json number,title,headRefName,baseRefName,mergeable,statusCheckRollup

Show a compact table and get confirmation.

2. For each confirmed PR:

   • git fetch origin <base-branch>
   • gh pr checkout <number>
   • git rebase origin/<base-branch>
   • On conflict, abort, mark needs-manual-intervention, and continue to the next PR.
   • Push rebased branch with git push --force-with-lease.

3. Validate dependency state:

   • Run pnpm install --frozen-lockfile.
   • If the lockfile must change, run pnpm install, commit the lockfile-only fix, and push.

4. Review:

   • Delegate analysis to fusion-dependency-review.
   • Capture upstream changes, security notes, existing discussion, impact, and confidence.
   • Post research with assets/research-comment-template.md.

5. Changesets:

   • Follow .github/instructions/dependabot-pr.instructions.md.
   • Create, commit, and push only required changesets.

6. Validate:

pnpm test && pnpm build && pnpm -w check

Attempt only trivial fixes. Mark anything else for manual intervention.

7. Decide:

   • High confidence: post verdict from assets/verdict-comment-template.md, then gh pr merge <number> --squash --admin.
   • Medium confidence: merge only with --merge-medium approval; otherwise report.
   • Low confidence or failed validation: post verdict and do not merge.

8. Finish:

   • Return to main.
   • Report every PR as merged, skipped, failed, or needs manual intervention.

Expected Output

Also include posted-comment status, changeset files, validation results, and manual follow-ups.

Safety

Never merge without validation, comments, and confidence. Never force-push without --force-with-lease. Never continue a conflicted Dependabot rebase by guessing.