dependabot-mergelisted

# Dependabot PR Bulk Processor Audit, comment, and merge open dependabot PRs. Each PR gets a security review via the `review-dependency` skill, a comment with findings, and — if safe — a squash merge. **Argument**: `$ARGUMENTS` — optional filter (e.g., `golang`, `docker`, `npm`). Empty = process all open dependabot PRs. ## Prerequisites `ghsudo` (`pip install ghsudo`) for write operations; `review-dependency` skill. ## Workflow ### 1. Discover Open Dependabot PRs ```bash gh pr list --repo <owner>/<repo> --author 'app/dependabot' \ --json number,title,statusCheckRollup,mergeable --limit 50 ``` Extract per PR: number, title, CI status (which checks passed/failed), mergeable state. If `$ARGUMENTS` is set, keep only PRs whose title contains it. ### 2. Check for Unpushed Commits `git log @{upstream}..HEAD --oneline` (no upstream: `git log origin/$(git branch --show-current)..HEAD`). Unpushed commits → **alert the user and stop** — worktree agents fork from remote state and would miss them. ### 3. Classify PRs | Group | Condition | Action | |---|---|---| | **Green** | All CI checks passed + MERGEABLE | Audit, Comment, Merge | | **Red** | CI failures + MERGEABLE | Audit, Comment, `@dependabot rebase` | | **Conflicting** | CONFLICTING mergeable state | Comment conflict notice, `@dependabot rebase` | Present the classification table to the user and **ask for confirmation** before proceeding. ### 4. Spawn Review Agents For each PR, the coordinator **pre-creates an isol