Merge Dependabot PRs

Merge Dependabot PRs

@description Evaluate and merge dependabot PRs with parallel builds, dependency-aware batching, and transitive dep analysis. @arguments $REPO: GitHub org/repo (e.g., trailofbits/algo). $OPTIONS: Optional flags — "--skip-config-audit" skips Phase 0 (use in batch runs where config audit is a separate pass).

Clone $REPO if not already available locally:

gh repo clone $REPO /tmp/depbot-eval-$(echo "$REPO" | tr '/' '-') -- --depth=50 2>/dev/null || \
  (cd /tmp/depbot-eval-$(echo "$REPO" | tr '/' '-') && git fetch origin)

Work from `/tmp/depbot-eval-{repo-slug}` for all subsequent phases.

Execute every phase below sequentially. Do not stop or ask for confirmation at any phase.

Turn Budget Management

If you are running as a background agent with a `max_turns` cap:

• At 75% of turns used: Stop launching new evaluations. Merge any PRs already evaluated as PASS. Skip Phase 5's detailed reports — print only the summary table.
• At 90% of turns used: Immediately print whatever summary you have and stop. Do not start new evaluations or re-tests.
• Prioritize merging over analysis. If you must choose between thorough analysis of the last PR and merging already-evaluated PASS PRs, merge first.

Phase 0: Dependabot Config Audit

If `$OPTIONS` includes `--skip-config-audit`, skip this entire phase and proceed to Phase 1.

Detect all package ecosystems present in the repo by checking for these indicator files:

Indicator file(s)	Ecosystem
pyproject.toml + uv.lock	uv
pyproject.toml (no uv.lock), requirements*.txt, setup.py, setup.cfg	pip
Cargo.toml	cargo
package.json	npm
go.mod	gomod
Gemfile	bundler
Dockerfile, docker-compose.yml	docker
.github/workflows/*.yml	github-actions
composer.json	composer
*.csproj, *.fsproj	nuget

Read `.github/dependabot.yml`. Verify all five conditions:

1. Coverage — every detected ecosystem has a corresponding updates entry with the correct package-ecosystem value and appropriate directory (usually "/")
2. uv vs pip — if a directory has both pyproject.toml and uv.lock, the ecosystem MUST be uv, not pip. The pip ecosystem does not update uv.lock, which causes PRs that modify pyproject.toml but leave uv.lock out of sync. If any entry uses pip where uv is correct, flag it for correction.
3. Schedule — every entry has schedule.interval: "weekly"
4. Cooldown — every entry has a cooldown block with default-days: 7. This prevents dependabot from flooding the PR queue with rapid re-attempts after a PR is closed or merged.
5. Grouped updates — every entry has a groups key with at least one group using patterns: ["*"] or more specific grouping patterns

If the file is missing or any condition fails, create a corrective PR:

1. `git checkout -b fix/dependabot