dependabot-strategylisted

On-demand Category 1 researcher focused on Dependabot best practices for a regulated organization — triage workflows, grouped-update strategies, auto-merge gates, ecosystem coverage, private-registry integration, cooldown periods for zero-day waiting, and the auto-triage rules that turn alert volume into actionable signal. Enforces Obsidian-first contract. Findings land at vault/research/dependabot/YYYY-MM-DD-{slug}.md; verified facts get staged for memory-curator promotion to vault/facts/ghas-dependabot/. Used by dependabot-config-helper as the source of defaults. Use when the user asks a strategic, policy, triage, or tooling question about Dependabot that needs a research-grade answer with citations — not when generating or reviewing a concrete dependabot.yml (dependabot-config-helper) or researching a non-Dependabot GHAS feature (ghas-feature-research).
themarmack/research-bot · ★ 0 · AI & Automation · score 68

Install: claude install-skill themarmack/research-bot

# dependabot-strategy The research side of the Dependabot pair. Produces the policy / strategy / triage research notes that the `dependabot-config-helper` skill consumes when generating actual `dependabot.yml` files. Treats Dependabot as a control surface, not just a config file — the *why* drives the *what*. ## When to use - Strategic question: "Should we adopt grouped updates? What's the cost?" - Policy question: "What's the right schedule cadence for ecosystem X in a SOX-regulated environment?" - Triage question: "We have 12,000 open Dependabot alerts — how do other regulated orgs handle this?" - Tooling question: "What auto-triage / auto-merge gates are people running in 2026?" ## When NOT to use - Specific `dependabot.yml` generation — that's `dependabot-config-helper`. - Individual alert triage — out of this skill's scope (and no skill in the catalog covers it). - GHAS-wide strategy beyond Dependabot — broader question, [`ghas-feature-research`](../ghas-feature-research/SKILL.md). ## Obsidian-first workflow (mandatory) 1. **Query the vault first** via `vault-querier`: - Full-text search the question's key terms across `vault/facts/ghas-dependabot/**`, `vault/research/dependabot/**`, `vault/research/github/**` (older Dependabot notes live there), and recent `vault/digests/**` (last 90 days — `daily-cve-digest` output often carries Dependabot-coverage observations). - Backlink check on `[[dependabot]]` and the question's entities (ecosystems, registries). 2.