feat: dependabot-triage skill; drop claude-config submodule#459
Merged
amit-gazal-thenvoi merged 9 commits intoJul 23, 2026
Merged
Conversation
Adds a playbook skill for handling the repo's open Dependabot PRs as a single test-gated batch: survey the queue by ecosystem, consolidate every uv bump onto one local branch, prove it with the full suite (including crewai in its own venv), approve the PRs that pass with a signed comment, and leave excluded bumps open with a Linear follow-up. Motivated by an a2a-sdk major upgrade that got starved: its bump PR was closed unmerged, and the uv open-PR limit then saturated with untriaged green PRs, so Dependabot never re-proposed the newer version. The skill keeps the queue drained so the per-ecosystem limit can't silently starve future upgrades. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…relocate skill - Remove the `claude-config` git submodule (band-ai/claude-config) mounted at `.claude`, along with its `.gitmodules` entry. - Inline its shared rules (`.claude/rules/00-05,07`) into AGENTS.md under a new "## Engineering Rules" section. CLAUDE.md symlinks to AGENTS.md, so both Claude Code and Codex load them from one file. Dropped the obsolete `06-claude-config-management` rule and the now-false "clone with --recurse-submodules" instructions. - Move the dependabot-triage skill from `.github/skills/` (not a discovery path) to `.claude/skills/dependabot-triage/` so Claude discovers it as a project skill — now repo-local instead of living in the shared submodule. - Keep `.claude/settings.local.json` machine-local (gitignored). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
amit-gazal-thenvoi
changed the title
…tion-for-dependabot-prs-INT-973
The rules inlined into AGENTS.md (## Engineering Rules) carry illustrative python snippets (undefined logger/pytest/api_key/MockDataFactory, etc.). In the former claude-config submodule these were never executed by pytest-markdown-docs (submodule files aren't in the main repo's git ls-files); inlined, CI ran them and 18 fences failed. Mark the 15 in-section python fences `notest` to match their illustrative intent, matching the repo's Documentation Testing convention. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
amit-gazal-thenvoi
changed the title
- AGENTS.md: align inlined Engineering Rules with the repo — Python 3.11+ (not 3.10+), and reframe the ruff config as a generic example (repo has no [tool.ruff] block) with py311 and the real package name. - dependabot-triage skill: reference the actual Linear MCP save_issue tool instead of a nonexistent create_issue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
AlexanderZ-Band
left a comment
AlexanderZ-Band
left a comment
Collaborator
There was a problem hiding this comment.
Docs/skill PR — no source touched, low risk. Skill content verified accurate against repo (dependabot limits, crewai pin split, uv lock --check trap all match). CI safe: SKILL.md has no python fences and every inlined AGENTS.md python fence is notest.
Four non-blocking nits, all in the inlined AGENTS.md rules. Common root: the inlined generic rules overlap/contradict the file's existing, repo-specific content. Suggest trimming the inlined block to what the top sections lack, or reconciling it to repo reality.
AlexanderZ-Band
previously approved these changes
Jul 23, 2026
AlexanderZ-Band
left a comment
AlexanderZ-Band
left a comment
Collaborator
There was a problem hiding this comment.
approved with coments
Address PR review nits: the inlined generic claude-config rules overlapped or contradicted the file's existing repo-specific sections. Drop the generic Coding Standards (dup of ## Coding Standards, incl. the stale Context7 line), Code Quality (dup of ## Commands), Testing Conventions (its tests/ tree wrongly showed tests/unit/), and Optional Dependencies (used a bogus thenvoi/mypackage name) subsections. Keep only what the sections above lack: Error Handling, Git Workflow, and the GitHub PR inline-comment recipe. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The provenance note narrated what was removed and why, which is PR/git history — not something a reader of the rules needs. Comments should describe the content as it is. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Error Handling, Git Workflow, and GitHub PR Inline Comments now stand as top-level sections instead of nesting under an Engineering Rules wrapper. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
amit-gazal-thenvoi
deleted the
feat/design-an-automation-for-dependabot-prs-INT-973
branch
July 23, 2026 06:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
dependabot-triageskill and reorganizes agent config so the skill lives in a discoverable, repo-local place — which meant unwinding the sharedclaude-configsubmodule.1.
dependabot-triageskillTriage the whole Dependabot queue in one test-gated batch: survey the queue, consolidate every
uvbump onto one branch, prove it with the full suite, approve the PRs that pass, and file Linear follow-ups for the rest — so the per-ecosystemopen-pull-requests-limitnever silently starves new upgrades. Now includes the lessons from an end-to-end run: failure attribution (env/lane/plan vs. real regression), crewai's exact-pin +dev-crewaitesting, and a full "Merging the approved set" section (serialuv.lockcascade,main's dismiss-stale-approvals ruleset, and theuv lock --checkspecifier-drift fix).Lives at
.claude/skills/dependabot-triage/SKILL.md(a Claude project-skill discovery path), so it surfaces as/dependabot-triage.2. Drop the
claude-configsubmodule.claudewas the sharedband-ai/claude-configsubmodule. To keep the skill repo-local (not leak an SDK-specific skill to every repo), the submodule is removed and its content inlined:AGENTS.mdunder a new## Engineering Rulessection (Coding Standards, Error Handling, Git Workflow, Code Quality, Testing, Optional Dependencies, GitHub PR Comments).CLAUDE.mdsymlinks toAGENTS.md, so both Claude and Codex load them from one file.06-claude-config-managementrule and the now-false "clone with--recurse-submodules" instructions..gitmodulesremoved;.claude/settings.local.jsonkept machine-local (gitignored).Notes
claude-configare unaffected — this only changes this repo's copy.CLAUDE.md → AGENTS.mdsymlink preserved.🤖 Generated with Claude Code