triage-dependabot-prlisted

# Triage a Dependabot PR Parse the invocation arguments: first token is the PR number. Optional `--repo owner/repo` specifies the repo — if not provided, detect from current directory. ## 1. Resolve repo If `--repo` not in arguments: ```bash gh repo view --json nameWithOwner -q '.nameWithOwner' ``` Set REPO (e.g. `my-org/my-repo`) and REPO_SLUG (replace `/` with `_`, e.g. `my-org_my-repo`). ## 2. Fetch PR context ```bash gh pr view $PR --repo $REPO --json number,title,body,author,headRefName,baseRefName,files,url gh api "repos/$REPO/actions/runs?branch=$(gh pr view $PR --repo $REPO --json headRefName -q '.headRefName')&per_page=5" \ --jq '.workflow_runs[] | {name, status, conclusion}' 2>/dev/null || true ``` Extract: - `title` — e.g. "Bump axios from 1.6.0 to 1.7.0" - `body` — Dependabot's description - `headRefName` — branch name - `files` — changed files - CI check statuses (from Actions API — PATs do not have Checks API access) ## 3. Fetch the diff ```bash gh pr diff $PR --repo $REPO ``` Look at the actual version bumps — what changed and how many semver levels. ## 4. Analyze risk **Recommendation options:** - `merge` — safe patch/minor update, no breaking changes, low risk - `review` — significant bump, possible breaking changes, or security-relevant - `hold` — known breaking change, deprecated package, or requires code changes first **Flags to assess:** - `breakingChange` — major version bump (X.0.0 → Y.0.0), or body explicitly mentions breaking changes -