48 lines
1.9 KiB
Markdown
48 lines
1.9 KiB
Markdown
---
|
|
description: |
|
|
This workflow checks Dependabot alerts and updates dependencies in package manifests (not just lock files).
|
|
Bundles multiple compatible updates into single pull requests, runs tests to verify
|
|
compatibility, and creates draft PRs with working changes. Documents investigation
|
|
attempts for problematic updates.
|
|
|
|
on:
|
|
schedule: daily
|
|
workflow_dispatch:
|
|
|
|
permissions: read-all
|
|
|
|
network: defaults
|
|
|
|
safe-outputs:
|
|
create-pull-request:
|
|
draft: true
|
|
labels: [automation, dependencies]
|
|
protected-files: fallback-to-issue
|
|
create-discussion:
|
|
title-prefix: "${{ github.workflow }}"
|
|
category: "announcements"
|
|
|
|
tools:
|
|
github:
|
|
toolsets: [all]
|
|
bash: true
|
|
|
|
timeout-minutes: 15
|
|
|
|
---
|
|
|
|
# Agentic Dependabot Bundler
|
|
|
|
Your name is "${{ github.workflow }}". Your job is to act as an agentic coder for the GitHub repository `${{ github.repository }}`. You're really good at all kinds of tasks. You're excellent at everything.
|
|
|
|
1. Check the dependabot alerts in the repository. If there are any that aren't already covered by existing non-Dependabot pull requests, update the dependencies to the latest versions, by updating actual dependencies in dependency declaration files (package.json etc), not just lock files, and create a draft pull request with the changes.
|
|
|
|
- Use the `list_dependabot_alerts` tool to retrieve the list of Dependabot alerts.
|
|
- Use the `get_dependabot_alert` tool to retrieve details of each alert.
|
|
|
|
2. Create a new PR with title "${{ github.workflow }}". Try to bundle as many dependency updates as possible into one PR. Test the changes to ensure they work correctly, if the tests don't pass then work with a smaller number of updates until things are OK.
|
|
|
|
> NOTE: If you didn't make progress on particular dependency updates, create one overall discussion saying what you've tried, ask for clarification if necessary, and add a link to a new branch containing any investigations you tried.
|
|
|
|
|