docs: add merging-dependabot-prs skill - #1877
Merged
Merged
Conversation
Triaging the Dependabot queue was undocumented, and the rule is not derivable from the repo: history contradicts itself on whether a test-scope minor bump needs a WW ticket. Three agents given the same queue produced three different verdicts. The skill fixes the classification on the dependency's real Maven scope rather than on Dependabot's own labels, which are unreliable here -- hibernate-core and maven-wrapper both announce direct:production and only one of them ships. A ticket is required only for a compile, runtime or provided scope dependency (optional included, since it is published in the module POM) at minor or major. Patch bumps, test-scope deps, apps/ showcase deps, GitHub Actions and Maven plugins merge bare. It also pins down what "the build passed" means. The ASF Jenkins pr-merge context is not a required check in .asf.yaml and flakes red on otherwise-green PRs, so the signal is the Build and Test matrix. One deliberate change from prior practice: the ticket ID now reaches the squash commit subject via --subject. Previously it lived only in the PR title and body, so git log --grep WW- never found dependency bumps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a project skill for triaging and landing the Dependabot queue.
Why
The rule is not derivable from the repository — the history contradicts itself.
org.htmlunit:htmlunit4.21→5.1 (test scope, major) got WW-5634, whileorg.webjars:jquery3.7.1→4.0.0 (test scope, major) and htmlunit's own 5.1→5.4 minors merged with no ticket. Three agents given the same open queue produced three different ticket verdicts: none, one, and four.What it fixes the rule to
Classification keys off the dependency's real Maven scope, not Dependabot's labels —
hibernate-coreandmaven-wrapperboth announcedependency-type: direct:productionand only one of them ships to users.A WW ticket is required only for a compile / runtime / provided scope dependency at minor or major,
<optional>true</optional>included since it is published in the module's POM. Patch bumps,<scope>test</scope>deps,apps/showcase deps, GitHub Actions and Maven plugins all merge bare on a green build.This deliberately supersedes the ticketing of test-scope minors seen in WW-5565/5570, WW-5566/5583 and WW-5596.
Two things it pins down
What "the build passed" means.
continuous-integration/jenkins/pr-mergeis not a required context in.asf.yamland flakes red ("This commit cannot be built") on otherwise-green PRs — #1867 and #1834 are both in that state right now. The signal is theBuild and Testmatrix; the required contexts areBuild and Test (JDK 17)onmainandBuild and Test (8)onsupport/struts-6-x-x.The ticket ID now reaches the commit. Previously it lived only in the PR title and body: GitHub took the squash subject from Dependabot's commit headline, so
1f1674411readsbuild(deps): bump jackson.version from 2.21.4 to 2.22.0 (#1746)even though the PR title carried WW-5648. The skill merges with an explicit--subject, sogit log --grep WW-finds dependency bumps.Ticket
None —
.claude/changes take conventional-commit form perCLAUDE.md.🤖 Generated with Claude Code