diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 1fd9aaf..67544f5 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -29,7 +29,7 @@ { "name": "dependabot", "description": "Check for dependency updates using Dependabot CLI with auto-detection of package managers", - "version": "1.3.0", + "version": "1.4.0", "source": "./plugins/dependabot", "category": "development", "author": { diff --git a/plugins/dependabot/.claude-plugin/plugin.json b/plugins/dependabot/.claude-plugin/plugin.json index 11f6709..900e6a1 100644 --- a/plugins/dependabot/.claude-plugin/plugin.json +++ b/plugins/dependabot/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "dependabot", - "version": "1.3.0", + "version": "1.4.0", "description": "Check for dependency updates using Dependabot CLI with auto-detection of package managers", "license": "MIT", "author": { diff --git a/plugins/dependabot/skills/dependabot/SKILL.md b/plugins/dependabot/skills/dependabot/SKILL.md index 8dbce6f..47cd52e 100644 --- a/plugins/dependabot/skills/dependabot/SKILL.md +++ b/plugins/dependabot/skills/dependabot/SKILL.md @@ -5,7 +5,7 @@ description: This skill should be used when the user asks to "check dependencies # Dependabot Update Skill -Scan for dependency updates using the official Dependabot CLI and optionally create PRs for found updates. +Scan for dependency updates using the official Dependabot CLI. **Reference files:** - `references/ecosystems.md` - Complete list of supported ecosystems with aliases and detection methods @@ -36,11 +36,9 @@ command -v gh || echo "NOT_FOUND" Analyze the user's trigger phrase: - **"use dependabot"** → Scan ALL detected ecosystems -- **"use dependabot for terraform"** → Scan only `terraform` ecosystem -- **"use dependabot for npm"** → Scan only `npm_and_yarn` ecosystem -- **"use dependabot for github-actions"** or **"use dependabot for actions"** → Scan only `github_actions` ecosystem +- **"use dependabot for \"** → Scan only the specified ecosystem -See `references/ecosystems.md` for the complete alias mapping and detection methods. +Consult `references/ecosystems.md` for the complete alias-to-ecosystem mapping (e.g., "npm" → `npm_and_yarn`, "actions" → `github_actions`). ## 3. Ecosystem Auto-Detection @@ -111,78 +109,8 @@ No updates available. If no updates are found across all ecosystems: > "All dependencies are up-to-date!" -## 7. Offer PR Creation - -If updates were found, ask the user: - -> "Would you like to apply these updates and create a PR?" - -**If yes, and multiple ecosystems have updates, ask about PR strategy:** - -> "How would you like to organize the updates?" -> 1. **One PR per ecosystem** - Separate PRs for npm, terraform, etc. -> 2. **Single combined PR** - All updates in one PR - -## 8. Apply Updates and Create PR(s) - -Based on user's choice: - -### For Each PR to Create: - -1. **Create a feature branch:** - ```bash - # Ensure main is up-to-date before branching - git checkout main && git pull origin main - - # If branch already exists from a previous run, delete it first: - git branch -D dependabot/-updates 2>/dev/null || true - - git checkout -b dependabot/-updates - # or for combined: dependabot/all-updates - ``` - -2. **Apply changes manually:** - From the `create_pull_request` JSON events, extract the `updated-dependency-files` array. - Each entry contains: - - `name` - The file path (e.g., `.github/workflows/ci.yml`) - - `content` - The new file content - - `directory` - The directory (usually `/`) - - Use the Edit tool to update each file with the new content, or apply targeted edits - based on the `dependencies` array showing old → new versions. - -3. **Stage and commit changes:** - ```bash - git add - git commit -m "chore(deps): update dependencies - - Updated by Dependabot CLI - - Co-Authored-By: Claude Opus 4.5 " - ``` - -4. **Push and create PR:** - ```bash - git push -u origin dependabot/-updates - gh pr create --title "chore(deps): update dependencies" \ - --body "## Summary - - Dependency updates detected by Dependabot CLI - - ## Updates - - - ## Test plan - - [ ] Verify build passes - - [ ] Verify tests pass - - [ ] Review changelog for breaking changes - - 🤖 Generated with [Claude Code](https://claude.com/claude-code)" - ``` - -5. **Return to original branch** after PR creation. - ## Important Notes -- Always use `gh auth token` for authentication - never ask for tokens directly +- Always use `gh auth token` for authentication — never ask for tokens directly - Some ecosystems may require additional configuration (e.g., private registries) - If dependabot fails for an ecosystem, report the error and continue with others