From all-skills
Consolidates open Dependabot PRs into one tested branch and PR, grouped by ecosystem and risk, with baseline-diff verification and operator approval before merging.
How this skill is triggered — by the user, by Claude, or both
Slash command
/all-skills:dependabot-consolidatorThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Codifies the recipe proven on kina PR #36: collect open Dependabot PRs, consolidate into one tested branch and PR, verify with baseline-diff gates, and close out on operator approval. Single-repo, operator-supervised scope.
Codifies the recipe proven on kina PR #36: collect open Dependabot PRs, consolidate into one tested branch and PR, verify with baseline-diff gates, and close out on operator approval. Single-repo, operator-supervised scope.
List open Dependabot PRs with:
gh pr list --author "app/dependabot" --state open \
--json number,title,headRefName,files
Warning: never touch human-authored PRs in the same pass. The --author app/dependabot filter is the guard; verify it returns only bot-authored entries before proceeding.
Classify each PR as config-only Actions or code/package bump before creating the branch. Decision: consolidate-all vs split-actions-from-code.
.github/workflows/*.yml only): validated authoritatively by real GitHub CI running on the pushed branch. Low risk; consolidate freely.See group-by-risk.md for the full ecosystem × risk taxonomy.
Create branch and cherry-pick each Dependabot PR head in order:
git fetch origin
git checkout -b chore/consolidate-dependabot origin/main
For each PR (ordered low-risk first, MAJOR bumps last):
git cherry-pick <pr-head-sha>
Conflict rule — keep every bump: Dependabot PRs each target a distinct dependency. When cherry-pick conflicts arise, keep both sides (each bump targets a different line/package). Do not drop either side.
Pin-style preservation: Dependabot updates pins in two styles — @v4 major tag and full commit SHA with a # vX.Y.Z trailing comment. Read the file before cherry-picking to know which style applies; preserve that style after merge.
Lockfile handling: Before assuming a lockfile needs a manual update, run git check-ignore <lockfile>. If the lockfile is tracked, commit the updated version. For Cargo: cargo update -p <dep> for the specific crate only — do not run a global cargo update.
See consolidation-algorithm.md for full cherry-pick mechanics and edge cases.
THE key insight: run each gate on the merge-base (main) FIRST, then on the branch. Only a NEW failure — one that does not appear on main — is a regression worth blocking on.
Gate discipline:
cargo test, npm test, lint, type-check, build, integration scripts.main / merge-base. Capture output. Record pass/fail per gate.Local integration gates: some gates cannot run in GitHub CI (Apple Container cluster spawn, hardware-dependent tests). Run these on the operator machine under the same baseline-diff discipline. See local-integration-gates.md and /core:container for container-spawn patterns.
See baseline-diff-verification.md for worked kina examples and the full gate enumeration workflow.
Use /github:act to replay GitHub CI gates locally before pushing. See /github:workflows for workflow file interpretation.
Gate before merging:
gh pr checks — all checks passing)After operator approval:
gh pr merge <consolidated-pr-number> --squash
No attribution in the squash commit message.
For each superseded Dependabot PR, comment then verify closure:
gh pr comment <n> -b "Addressed by #<consolidated> (consolidated dependency update)"
gh pr view <n> --json state
Verify the state field is MERGED or CLOSED. Do not assume Dependabot auto-closes — confirm with gh pr view for each one.
See merge-and-closeout.md for the full close-out checklist.
Hand mechanical cherry-picking to dependabot-consolidator-worker.md. Read-only PR collection goes to dependabot-collector.md.
Stop-and-report gates (worker must halt, not thrash):
Hard constraint: agents never merge unilaterally. Merge is operator-approved and executed by the skill's close-out step.
See registration.md for the build checklist covering marketplace.json, plugin.json, and sources.md edits, plus the two validators to run before committing.
/core:anti-fabrication — never claim a gate passed without showing command output/core:container — local integration gates using Apple Container/github:act — replay CI gates locally before push/github:workflows — read and interpret workflow files/github:actions — understand action versions and pin stylesmain before blaming a bump for a failure.gh pr view <n> --json state — do not assert "Dependabot closed it."@v4 vs full-SHA style.git status output, not a paraphrase.See /core:anti-fabrication for the full discipline.
npx claudepluginhub vinnie357/claude-skills --plugin qaReviews open Dependabot PRs, classifies by risk (patch/minor/major/security/lockfile-only), merges safe ones via GitHub CLI, and advises on others. Use for dependency update triage.
Drives all open PRs toward merge-readiness by auditing 7 gates (CI, conflicts, reviews, comments, evidence, skeptic), fixing failures, and triggering missing checks.
Handles GitHub repository operations: issue triage, PR management, CI/CD debugging, release preparation, and security monitoring using the gh CLI.