Skip to content

docs(dependabot): improve skill clarity based on real-world usage v1.2.0 #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vnz merged 2 commits into from
Jan 26, 2026
Merged

docs(dependabot): improve skill clarity based on real-world usage v1.2.0 #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0744c2a
docs(dependabot): improve skill clarity based on real-world usage v1.2.0
vnz Jan 26, 2026
06adfd9
fix(dependabot): address skill review findings
vnz Jan 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .claude-plugin/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
{
"name": "dependabot",
"description": "Check for dependency updates using Dependabot CLI with auto-detection of package managers",
"version": "1.1.0",
"version": "1.2.0",
"source": "./plugins/dependabot",
"category": "development",
"author": {
Expand Down
2 changes: 1 addition & 1 deletion plugins/dependabot/.claude-plugin/plugin.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "dependabot",
"version": "1.1.0",
"version": "1.2.0",
"description": "Check for dependency updates using Dependabot CLI with auto-detection of package managers",
"license": "MIT",
"author": {
Expand Down
21 changes: 16 additions & 5 deletions plugins/dependabot/skills/dependabot.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
description: Check for dependency updates using Dependabot CLI. Trigger with "use dependabot" to scan all ecosystems or "use dependabot for <ecosystem>" for a specific one (e.g., terraform, npm, github-actions).
description: This skill should be used when the user asks to "check dependencies", "find outdated packages", "scan for updates", "use dependabot", "run dependabot", "check for security updates", "what needs updating", or requests dependency scanning for specific ecosystems like npm, terraform, or github-actions. Supports scanning all ecosystems or specific ones with "use dependabot for <ecosystem>".
---

# Dependabot Update Skill
Expand Down Expand Up @@ -92,7 +92,7 @@ For each ecosystem to scan, run the Dependabot CLI:
```bash
# Get the repository name dynamically
REPO=$(gh repo view --json owner,name --jq '.owner.login + "/" + .name')
LOCAL_GITHUB_ACCESS_TOKEN=$(gh auth token) dependabot update <ecosystem> "$REPO" --local .
LOCAL_GITHUB_ACCESS_TOKEN=$(gh auth token) dependabot update <ecosystem> "$REPO" --local . 2>&1
```

Where `<ecosystem>` is the CLI ecosystem value (e.g., `npm_and_yarn`, `terraform`, `github_actions`).
Expand All @@ -102,8 +102,9 @@ Where `<ecosystem>` is the CLI ecosystem value (e.g., `npm_and_yarn`, `terraform
**Understanding the output:**
- The CLI outputs **JSON lines** (one JSON object per line), NOT human-readable tables
- The CLI **never modifies files directly** - it only outputs data describing what would change
- The `--local .` flag means "use local filesystem as source" (not "dry-run")
- The `--local .` flag means "use local filesystem as source" — this prevents the CLI from cloning from GitHub and instead uses your working directory (it's NOT a "dry-run" flag)
- Output can be very large (40KB+) - it may be truncated
- **Important:** Use `2>&1` to capture both stdout and stderr, as the CLI mixes log messages (stderr) with JSON output (stdout)

## 5. Parse Results from JSON Output

Expand All @@ -121,7 +122,11 @@ Each `create_pull_request` event contains:
- `pr-title` - Suggested PR title
- `updated-dependency-files[]` - The actual file changes to apply

If no `create_pull_request` events are found, or only `mark_as_processed` appears, there are no updates.
**Determining if updates exist:**
- ✅ **Updates found:** One or more `create_pull_request` events in the output
- ❌ **No updates:** Only `mark_as_processed` events appear (no `create_pull_request`)

This is the definitive way to check — if you grep for `create_pull_request` and get no results, that ecosystem is up-to-date.

## 6. Present Results

Expand Down Expand Up @@ -163,6 +168,12 @@ Based on user's choice:

1. **Create a feature branch:**
```bash
# Ensure main is up-to-date before branching
git checkout main && git pull origin main

# If branch already exists from a previous run, delete it first:
git branch -D dependabot/<ecosystem>-updates 2>/dev/null || true

git checkout -b dependabot/<ecosystem>-updates
Comment on lines +174 to 177
Copy link

@gemini-code-assist gemini-code-assist bot Jan 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

To make the script more robust for re-runs, it's best to first switch to the repository's default branch. This ensures the new branch is always created from the correct base, preventing branching from another feature branch. Additionally, you can simplify the branch creation logic. Using git checkout -B <branch> will create the branch if it doesn't exist, or reset it to the current HEAD if it does. This is more concise than deleting and then creating it.

Suggested change
# If branch already exists from a previous run, delete it first:
git branch -D dependabot/<ecosystem>-updates 2>/dev/null || true
git checkout -b dependabot/<ecosystem>-updates
# Switch to default branch and create/reset the feature branch
DEFAULT_BRANCH=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name)
git checkout "$DEFAULT_BRANCH"
git checkout -B dependabot/<ecosystem>-updates

# or for combined: dependabot/all-updates
```
Expand Down Expand Up @@ -204,7 +215,7 @@ Based on user's choice:
- [ ] Verify tests pass
- [ ] Review changelog for breaking changes

🤖 Generated with [Claude Code](https://claude.ai/claude-code)"
🤖 Generated with [Claude Code](https://claude.com/claude-code)"
```

5. **Return to original branch** after PR creation.
Expand Down