Skip to content

feat: add Dependabot consolidation skill - #9443

Open
vhvb1989 wants to merge 1 commit into
mainfrom
feature/dependabot-consolidation-skill
Open

feat: add Dependabot consolidation skill#9443
vhvb1989 wants to merge 1 commit into
mainfrom
feature/dependabot-consolidation-skill

Conversation

@vhvb1989

@vhvb1989 vhvb1989 commented Aug 5, 2026

Copy link
Copy Markdown
Member

Summary

  • add a reusable workflow skill for consolidating repository Dependabot PRs and security alerts
  • reuse an existing marked consolidation PR when available
  • validate grouped updates and close only source PRs proven incorporated
  • document authenticated registry and blocked-update handling

Validation

  • git diff --cached --check

No evaluation files are included in this change.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 31fa6854-d00e-4dd6-a2cb-b2f860d6375a
Copilot AI balanced review requested due to automatic review settings August 5, 2026 16:56
@vhvb1989 vhvb1989 added the skip-governance Skip PR governance checks label Aug 5, 2026
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
22 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

🔗 Linked Issue Required

Thanks for the contribution! Please link a GitHub issue to this PR by adding Fixes #123 to the description or using the sidebar.
No issue yet? Feel free to create one!

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a workflow skill to consolidate Dependabot updates and security alerts into one maintained PR.

Changes:

  • Defines skill triggers, safeguards, and exit criteria.
  • Documents inventory, validation, PR reuse, and source-PR closure workflows.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File Description
.github/skills/dependabot-consolidation/SKILL.md Defines the skill and safety rules.
.github/skills/dependabot-consolidation/references/workflow.md Provides the detailed consolidation procedure.

Comment on lines +41 to +43
gh pr list --repo Azure/azure-dev --state open --author app/dependabot \
--limit 200 \
--json number,title,url,headRefName,baseRefName,files,commits,mergeable
Comment on lines +90 to +92
- Fetch and check out the existing head branch.
- Bring in the latest `origin/main` without rewriting published history. Prefer a normal merge
when required; do not force-push.
Comment on lines +266 to +267
1. Re-fetch the list of open Dependabot PRs to avoid acting on stale state.
2. For each still-open PR recorded as incorporated, comment:

1. Verify every incorporated source PR's intended version and file changes.
2. Verify every covered alert group's resolved version is no longer vulnerable.
3. Review `git diff --stat origin/main...HEAD` and the full diff for unrelated changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

skip-governance Skip PR governance checks

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants