@olegkoval/agent-skills 1.25.0 → 1.27.0

package/packages/software-development/dependabot-triage/adapters/claude/skills/dependabot-triage/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: dependabot-triage
+description: >
+  Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor /
+  major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with
+  a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling
+  up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe
+  ones", or at the start of a maintenance window.
+license: MIT
+allowed-tools: Bash, Read, Write
+compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires git and gh (GitHub CLI) authenticated.
+metadata:
+  targets: [_source-only]
+  author: Oleg Koval
+  tags:
+    - dependabot
+    - renovate
+    - dependencies
+    - security
+    - automation
+    - triage
+    - github
+source: weekly-pattern-learner
+source_reason: "obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them"
+source_date: "2026-07-31"
+---
+<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
+
+> 🤖 *Auto-generated by **weekly-pattern-learner** · obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them*
+
+# Dependabot Triage
+
+Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe,
+flag what needs a human decision, and report what was done.
+
+## Inputs
+
+- **Repository** (optional): default to the current repo.
+- **Auto-merge policy** (optional, default: `patch-only`): `none`, `patch-only`, or `patch-and-minor`.
+- **Require CI** (optional, default: on): only merge PRs whose checks are green.
+
+## Step 1 — Fetch all open dependency PRs
+
+```bash
+# Dependabot PRs
+gh pr list --state open --label "dependencies" \
+  --json number,title,author,labels,headRefName,url,isDraft \
+  --jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'
+
+# Also catch Renovate PRs not labelled "dependencies"
+gh pr list --state open \
+  --json number,title,author,labels,headRefName,url,isDraft \
+  --jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'
+```
+
+Merge both result sets, deduplicate by number, skip drafts.
+
+## Step 2 — Classify each PR
+
+Parse the PR title to extract package name and version change.
+
+Dependabot title format: `Bump <package> from <old> to <new>`
+Renovate title format: `Update dependency <package> to v<new>` or `chore(deps): update <package>`
+
+For each PR:
+
+```bash
+gh pr view <NUMBER> --json title,body,labels,reviews \
+  --jq '{title, body: (.body | .[0:500]), labels: [.labels[].name], reviews: [.reviews[].state]}'
+```
+
+Classify:
+
+| Tier | Condition | Default action |
+|------|-----------|----------------|
+| **patch** | semver patch bump (`X.Y.Z → X.Y.Z+1`), no security label | auto-approve and merge (if CI green) |
+| **minor** | semver minor bump (`X.Y.Z → X.Y+1.0`), no security label | approve and merge when `patch-and-minor` policy |
+| **major** | semver major bump (`X.Y.Z → X+1.0.0`) | flag for human: summarize breaking changes |
+| **security** | has `security` label, or title contains "CVE" or "vulnerability" | escalate: approve if CI green AND patch/minor; human if major |
+
+When in doubt about the bump type (e.g. non-semver packages), treat as `minor`.
+
+## Step 3 — Check CI for merge candidates
+
+For each PR classified as auto-approvable:
+
+```bash
+gh pr checks <NUMBER> --json name,state,conclusion \
+  --jq '[.[] | select(.conclusion != "success" and .conclusion != "skipped")] | length'
+```
+
+If CI is still running, wait up to 10 minutes (polling every 30s). If CI fails, demote
+to `blocked` — do not merge a PR with failing checks regardless of policy.
+
+If CI is disabled for dependency PRs in this repo (no checks at all), note it and proceed
+only when the user has passed `--skip-ci-check` explicitly.
+
+## Step 4 — Approve and merge safe PRs
+
+For each auto-approvable PR with green CI:
+
+```bash
+# Approve
+gh pr review <NUMBER> --approve --body "Auto-approved by dependabot-triage: patch bump, CI green."
+
+# Merge (squash is the default; use the repo's configured merge strategy if known)
+gh pr merge <NUMBER> --squash --delete-branch \
+  --subject "$(gh pr view <NUMBER> --json title --jq .title)"
+```
+
+If the merge fails (conflict, branch protection, etc.), fall back to `blocked` and note it.
+
+## Step 5 — Comment on flagged PRs
+
+For each `major` or `blocked` PR, post one comment summarizing why it needs a human:
+
+```bash
+gh pr comment <NUMBER> --body "**dependabot-triage:** This is a major version bump. \
+Review the changelog before merging: $(gh pr view <NUMBER> --json body --jq '.body | split("\n") | map(select(test("changelog|release|BREAKING"; "i"))) | .[0]').
+
+No action was taken."
+```
+
+## Step 6 — Report
+
+Print a digest, then stop. Do not merge anything not listed as approved in this report.
+
+```
+Dependabot triage complete.
+  Merged (patch, CI green):   7 PRs  →  lodash 4.17.20→4.17.21, eslint 8.56.0→8.57.0, ...
+  Merged (security, CI green): 1 PR  →  axios 1.6.2→1.7.9 (CVE-2024-39338)
+  Flagged for human review:    2 PRs →  next.js 14→15 (major), @types/node 20→22 (major)
+  Blocked (CI failing):        1 PR  →  typescript 5.4→5.5 (lint errors)
+  Skipped (draft):             1 PR
+
+  Open a flagged PR and run /pr-to-green after reviewing the changelog.
+```
+
+## Safety guardrails
+
+- Never merge a PR whose author is not `dependabot[bot]` or `renovate[bot]`, even if found by the label query.
+- Never merge a major bump automatically, even if `patch-and-minor` policy is set.
+- Never approve a PR if `gh pr checks` shows any failure — a quiet pass is not the same as no checks.
+- Always post a comment on flagged PRs so the record is visible in the thread.
+
+## Chaining
+
+| Before this skill | After this skill |
+|---|---|
+| morning routine / maintenance window | `olko:pr-to-green` on flagged PRs after human review |
+| `olko:obsidian-pr-sync` (which filters these out) | back to obsidian-pr-sync for remaining human PRs |

package/packages/software-development/dependabot-triage/adapters/codex/README.md

@@ -0,0 +1,19 @@
+# Codex Adapter for dependabot-triage
+
+This is a Codex-specific adapter for the `olko:dependabot-triage` skill.
+The canonical skill definition is in `../../SKILL.md`.
+
+## Usage
+
+Invoke in a Codex session:
+
+```text
+Use the olko:dependabot-triage skill to triage the open Dependabot PRs in this repo.
+```
+
+## Workflow
+
+See `../../SKILL.md` for the full workflow: fetch all open Dependabot and Renovate PRs,
+classify each by risk tier (patch/minor/major/security), auto-approve and merge safe
+patch bumps whose CI is green, flag major upgrades with a comment for human review, and
+post a digest of what was done. The procedure is plain `gh` and is agent-agnostic.

package/packages/software-development/dependabot-triage/adapters/cursor/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "olko:dependabot-triage",
+  "version": "0.1.0",
+  "description": "Triage open Dependabot and Renovate PRs in bulk: classify by risk tier, auto-approve and merge safe patch bumps, flag breaking major upgrades for human review, and post a digest.",
+  "skills": "skills/"
+}

package/packages/software-development/dependabot-triage/adapters/cursor/skills/dependabot-triage/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: dependabot-triage
+description: >
+  Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor /
+  major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with
+  a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling
+  up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe
+  ones", or at the start of a maintenance window.
+license: MIT
+allowed-tools: Bash, Read, Write
+compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires git and gh (GitHub CLI) authenticated.
+metadata:
+  targets: ["cursor"]
+  author: Oleg Koval
+  tags:
+    - dependabot
+    - renovate
+    - dependencies
+    - security
+    - automation
+    - triage
+    - github
+source: weekly-pattern-learner
+source_reason: "obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them"
+source_date: "2026-07-31"
+---
+<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
+
+> 🤖 *Auto-generated by **weekly-pattern-learner** · obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them*
+
+# Dependabot Triage
+
+Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe,
+flag what needs a human decision, and report what was done.
+
+## Inputs
+
+- **Repository** (optional): default to the current repo.
+- **Auto-merge policy** (optional, default: `patch-only`): `none`, `patch-only`, or `patch-and-minor`.
+- **Require CI** (optional, default: on): only merge PRs whose checks are green.
+
+## Step 1 — Fetch all open dependency PRs
+
+```bash
+# Dependabot PRs
+gh pr list --state open --label "dependencies" \
+  --json number,title,author,labels,headRefName,url,isDraft \
+  --jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'
+
+# Also catch Renovate PRs not labelled "dependencies"
+gh pr list --state open \
+  --json number,title,author,labels,headRefName,url,isDraft \
+  --jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'
+```
+
+Merge both result sets, deduplicate by number, skip drafts.
+
+## Step 2 — Classify each PR
+
+Parse the PR title to extract package name and version change.
+
+Dependabot title format: `Bump <package> from <old> to <new>`
+Renovate title format: `Update dependency <package> to v<new>` or `chore(deps): update <package>`
+
+For each PR:
+
+```bash
+gh pr view <NUMBER> --json title,body,labels,reviews \
+  --jq '{title, body: (.body | .[0:500]), labels: [.labels[].name], reviews: [.reviews[].state]}'
+```
+
+Classify:
+
+| Tier | Condition | Default action |
+|------|-----------|----------------|
+| **patch** | semver patch bump (`X.Y.Z → X.Y.Z+1`), no security label | auto-approve and merge (if CI green) |
+| **minor** | semver minor bump (`X.Y.Z → X.Y+1.0`), no security label | approve and merge when `patch-and-minor` policy |
+| **major** | semver major bump (`X.Y.Z → X+1.0.0`) | flag for human: summarize breaking changes |
+| **security** | has `security` label, or title contains "CVE" or "vulnerability" | escalate: approve if CI green AND patch/minor; human if major |
+
+When in doubt about the bump type (e.g. non-semver packages), treat as `minor`.
+
+## Step 3 — Check CI for merge candidates
+
+For each PR classified as auto-approvable:
+
+```bash
+gh pr checks <NUMBER> --json name,state,conclusion \
+  --jq '[.[] | select(.conclusion != "success" and .conclusion != "skipped")] | length'
+```
+
+If CI is still running, wait up to 10 minutes (polling every 30s). If CI fails, demote
+to `blocked` — do not merge a PR with failing checks regardless of policy.
+
+If CI is disabled for dependency PRs in this repo (no checks at all), note it and proceed
+only when the user has passed `--skip-ci-check` explicitly.
+
+## Step 4 — Approve and merge safe PRs
+
+For each auto-approvable PR with green CI:
+
+```bash
+# Approve
+gh pr review <NUMBER> --approve --body "Auto-approved by dependabot-triage: patch bump, CI green."
+
+# Merge (squash is the default; use the repo's configured merge strategy if known)
+gh pr merge <NUMBER> --squash --delete-branch \
+  --subject "$(gh pr view <NUMBER> --json title --jq .title)"
+```
+
+If the merge fails (conflict, branch protection, etc.), fall back to `blocked` and note it.
+
+## Step 5 — Comment on flagged PRs
+
+For each `major` or `blocked` PR, post one comment summarizing why it needs a human:
+
+```bash
+gh pr comment <NUMBER> --body "**dependabot-triage:** This is a major version bump. \
+Review the changelog before merging: $(gh pr view <NUMBER> --json body --jq '.body | split("\n") | map(select(test("changelog|release|BREAKING"; "i"))) | .[0]').
+
+No action was taken."
+```
+
+## Step 6 — Report
+
+Print a digest, then stop. Do not merge anything not listed as approved in this report.
+
+```
+Dependabot triage complete.
+  Merged (patch, CI green):   7 PRs  →  lodash 4.17.20→4.17.21, eslint 8.56.0→8.57.0, ...
+  Merged (security, CI green): 1 PR  →  axios 1.6.2→1.7.9 (CVE-2024-39338)
+  Flagged for human review:    2 PRs →  next.js 14→15 (major), @types/node 20→22 (major)
+  Blocked (CI failing):        1 PR  →  typescript 5.4→5.5 (lint errors)
+  Skipped (draft):             1 PR
+
+  Open a flagged PR and run /pr-to-green after reviewing the changelog.
+```
+
+## Safety guardrails
+
+- Never merge a PR whose author is not `dependabot[bot]` or `renovate[bot]`, even if found by the label query.
+- Never merge a major bump automatically, even if `patch-and-minor` policy is set.
+- Never approve a PR if `gh pr checks` shows any failure — a quiet pass is not the same as no checks.
+- Always post a comment on flagged PRs so the record is visible in the thread.
+
+## Chaining
+
+| Before this skill | After this skill |
+|---|---|
+| morning routine / maintenance window | `olko:pr-to-green` on flagged PRs after human review |
+| `olko:obsidian-pr-sync` (which filters these out) | back to obsidian-pr-sync for remaining human PRs |

package/packages/software-development/dependabot-triage/adapters/grok/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "olko:dependabot-triage",
+  "version": "0.1.0",
+  "description": "Triage open Dependabot and Renovate PRs in bulk: classify by risk tier, auto-approve and merge safe patch bumps, flag breaking major upgrades for human review, and post a digest.",
+  "skills": "skills/"
+}

package/packages/software-development/dependabot-triage/adapters/grok/skills/dependabot-triage/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: dependabot-triage
+description: >
+  Triage all open Dependabot and Renovate PRs in bulk: classify each by risk tier (patch / minor /
+  major / security), auto-approve and merge safe patch-only bumps, flag breaking major upgrades with
+  a summary of what changed, and post a digest of what was done. Use when dependency PRs are piling
+  up, when the user says "deal with Dependabot", "triage dependency updates", or "merge the safe
+  ones", or at the start of a maintenance window.
+license: MIT
+allowed-tools: Bash, Read, Write
+compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires git and gh (GitHub CLI) authenticated.
+metadata:
+  targets: [_source-only]
+  author: Oleg Koval
+  tags:
+    - dependabot
+    - renovate
+    - dependencies
+    - security
+    - automation
+    - triage
+    - github
+source: weekly-pattern-learner
+source_reason: "obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them"
+source_date: "2026-07-31"
+---
+<!-- Generated by scripts/build-adapters.sh. Do not edit directly. -->
+
+> 🤖 *Auto-generated by **weekly-pattern-learner** · obsidian-pr-sync explicitly filters out dependabot/renovate PRs — the user handles them separately, but no skill existed to batch-triage them*
+
+# Dependabot Triage
+
+Bulk-process open Dependabot and Renovate PRs: approve and merge what is safe,
+flag what needs a human decision, and report what was done.
+
+## Inputs
+
+- **Repository** (optional): default to the current repo.
+- **Auto-merge policy** (optional, default: `patch-only`): `none`, `patch-only`, or `patch-and-minor`.
+- **Require CI** (optional, default: on): only merge PRs whose checks are green.
+
+## Step 1 — Fetch all open dependency PRs
+
+```bash
+# Dependabot PRs
+gh pr list --state open --label "dependencies" \
+  --json number,title,author,labels,headRefName,url,isDraft \
+  --jq '.[] | select(.author.login | test("dependabot|renovate"; "i"))'
+
+# Also catch Renovate PRs not labelled "dependencies"
+gh pr list --state open \
+  --json number,title,author,labels,headRefName,url,isDraft \
+  --jq '.[] | select(.author.login == "renovate[bot]" or .author.login == "dependabot[bot]")'
+```
+
+Merge both result sets, deduplicate by number, skip drafts.
+
+## Step 2 — Classify each PR
+
+Parse the PR title to extract package name and version change.
+
+Dependabot title format: `Bump <package> from <old> to <new>`
+Renovate title format: `Update dependency <package> to v<new>` or `chore(deps): update <package>`
+
+For each PR:
+
+```bash
+gh pr view <NUMBER> --json title,body,labels,reviews \
+  --jq '{title, body: (.body | .[0:500]), labels: [.labels[].name], reviews: [.reviews[].state]}'
+```
+
+Classify:
+
+| Tier | Condition | Default action |
+|------|-----------|----------------|
+| **patch** | semver patch bump (`X.Y.Z → X.Y.Z+1`), no security label | auto-approve and merge (if CI green) |
+| **minor** | semver minor bump (`X.Y.Z → X.Y+1.0`), no security label | approve and merge when `patch-and-minor` policy |
+| **major** | semver major bump (`X.Y.Z → X+1.0.0`) | flag for human: summarize breaking changes |
+| **security** | has `security` label, or title contains "CVE" or "vulnerability" | escalate: approve if CI green AND patch/minor; human if major |
+
+When in doubt about the bump type (e.g. non-semver packages), treat as `minor`.
+
+## Step 3 — Check CI for merge candidates
+
+For each PR classified as auto-approvable:
+
+```bash
+gh pr checks <NUMBER> --json name,state,conclusion \
+  --jq '[.[] | select(.conclusion != "success" and .conclusion != "skipped")] | length'
+```
+
+If CI is still running, wait up to 10 minutes (polling every 30s). If CI fails, demote
+to `blocked` — do not merge a PR with failing checks regardless of policy.
+
+If CI is disabled for dependency PRs in this repo (no checks at all), note it and proceed
+only when the user has passed `--skip-ci-check` explicitly.
+
+## Step 4 — Approve and merge safe PRs
+
+For each auto-approvable PR with green CI:
+
+```bash
+# Approve
+gh pr review <NUMBER> --approve --body "Auto-approved by dependabot-triage: patch bump, CI green."
+
+# Merge (squash is the default; use the repo's configured merge strategy if known)
+gh pr merge <NUMBER> --squash --delete-branch \
+  --subject "$(gh pr view <NUMBER> --json title --jq .title)"
+```
+
+If the merge fails (conflict, branch protection, etc.), fall back to `blocked` and note it.
+
+## Step 5 — Comment on flagged PRs
+
+For each `major` or `blocked` PR, post one comment summarizing why it needs a human:
+
+```bash
+gh pr comment <NUMBER> --body "**dependabot-triage:** This is a major version bump. \
+Review the changelog before merging: $(gh pr view <NUMBER> --json body --jq '.body | split("\n") | map(select(test("changelog|release|BREAKING"; "i"))) | .[0]').
+
+No action was taken."
+```
+
+## Step 6 — Report
+
+Print a digest, then stop. Do not merge anything not listed as approved in this report.
+
+```
+Dependabot triage complete.
+  Merged (patch, CI green):   7 PRs  →  lodash 4.17.20→4.17.21, eslint 8.56.0→8.57.0, ...
+  Merged (security, CI green): 1 PR  →  axios 1.6.2→1.7.9 (CVE-2024-39338)
+  Flagged for human review:    2 PRs →  next.js 14→15 (major), @types/node 20→22 (major)
+  Blocked (CI failing):        1 PR  →  typescript 5.4→5.5 (lint errors)
+  Skipped (draft):             1 PR
+
+  Open a flagged PR and run /pr-to-green after reviewing the changelog.
+```
+
+## Safety guardrails
+
+- Never merge a PR whose author is not `dependabot[bot]` or `renovate[bot]`, even if found by the label query.
+- Never merge a major bump automatically, even if `patch-and-minor` policy is set.
+- Never approve a PR if `gh pr checks` shows any failure — a quiet pass is not the same as no checks.
+- Always post a comment on flagged PRs so the record is visible in the thread.
+
+## Chaining
+
+| Before this skill | After this skill |
+|---|---|
+| morning routine / maintenance window | `olko:pr-to-green` on flagged PRs after human review |
+| `olko:obsidian-pr-sync` (which filters these out) | back to obsidian-pr-sync for remaining human PRs |