From dependabot-merge
Finds all open Dependabot PRs on the current repository, combines them into a single branch, runs validation (tsc, tests, Docker build), and creates a combined PR. Use when the user says "merge dependabot", "combine dependabot PRs", "dependabot", or "update dependencies".
How this skill is triggered — by the user, by Claude, or both
Slash command
/dependabot-merge:merge-dependabotThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Consolidates all open Dependabot PRs into a single tested branch and PR.
Consolidates all open Dependabot PRs into a single tested branch and PR.
Before doing anything else, temporarily grant auto-approval for the commands this skill needs.
.claude/settings.json already exists in the project root.
.claude/ directory doesn't exist, create it..claude/settings.json with the following content (merging with existing settings if the file already existed — preserve all existing keys and only add/merge the permissions.allow entries):{
"permissions": {
"allow": [
"Bash(git status *)",
"Bash(git fetch *)",
"Bash(git checkout -b *)",
"Bash(git checkout *)",
"Bash(git merge *)",
"Bash(git merge --abort)",
"Bash(git push -u origin *)",
"Bash(git add *)",
"Bash(gh pr list *)",
"Bash(gh pr create *)",
"Bash(gh repo view *)",
"Bash(npm test*)",
"Bash(npm install*)",
"Bash(yarn install*)",
"Bash(pnpm install*)",
"Bash(npx tsc *)",
"Bash(npx eslint *)",
"Bash(docker build *)",
"Bash(docker rmi *)"
]
}
}
.claude/settings.json to .git/info/exclude so it won't show up in git status or get committed. Only add the line if it's not already present.gh repo view --json nameWithOwner -q '.nameWithOwner'
gh pr list --author "app/dependabot" --state open --json number,title,headRefName,baseRefName
git status --porcelain). If not, ask the user to commit or stash first.git fetch origin
main or master):
gh repo view --json defaultBranchRef -q '.defaultBranchRef.name'
git checkout -b chore/dependabot-combined-YYYY-MM-DD origin/<default-branch>
Use today's date in the branch name.For each Dependabot PR, in order:
git fetch origin <pr-branch>
git merge origin/<pr-branch> --no-edit
git merge --abort and continue with the next PR.Run the following checks sequentially. Stop and report on the first failure.
Only run if a tsconfig.json exists in the project root.
npx tsc --noEmit
If tsc fails, analyze the errors. If they are type errors caused by the dependency updates:
Only run if an ESLint config exists in the project (.eslintrc.*, eslint.config.*, or an eslintConfig key in package.json).
npx eslint .
If ESLint fails, analyze the errors. If they are caused by the dependency updates (e.g. new rule defaults from an updated plugin):
npx eslint . --fix.Detect the test runner from package.json scripts and run the test suite:
npm test
Or the equivalent (yarn test, pnpm test, etc.) based on the lockfile present.
If tests fail:
Only run if a Dockerfile exists in the project root.
docker build -t dependabot-validation-test .
If the build fails, report the error and ask the user how to proceed.
After successful validation, clean up the test image:
docker rmi dependabot-validation-test 2>/dev/null || true
git push -u origin chore/dependabot-combined-YYYY-MM-DD
gh:
gh pr create \
--title "chore(deps): combine dependabot updates YYYY-MM-DD" \
--body "$(cat <<'EOF'
## Summary
Combines the following Dependabot PRs into a single update:
<list each merged PR as "- #NUMBER TITLE">
<if any PRs were skipped, add:>
### Skipped PRs (merge conflicts)
<list each skipped PR as "- #NUMBER TITLE — reason">
## Validation
- [x] TypeScript compilation (or N/A)
- [x] ESLint (or N/A)
- [x] Test suite
- [x] Docker build (or N/A)
Closes <list each merged PR number as #NUMBER separated by commas>
EOF
)"
This phase MUST run regardless of whether the skill succeeded or failed. Even if an error occurs in any earlier phase, always execute this cleanup.
.claude/settings.json existed before Phase 0:
.claude/settings.json did NOT exist before Phase 0:
.claude/settings.json..claude/ directory is now empty, delete it too..claude/settings.json line from .git/info/exclude if it was added in Phase 0.Closes #N references.Provides a checklist for code reviews covering functionality, security, performance, maintainability, tests, and quality. Use for pull requests, audits, team standards, and developer training.
npx claudepluginhub jusi-dev/dev-marketplace --plugin dependabot-merge