I automated Dependabot PR cleanup — and drew a hard line on what NOT to automate

GitHub's automated Dependabot PR cleanup system can be a headache, as human intervention is often required to answer the same questions repeatedly. To address this, a CLI tool called dep-triage was developed. It categorizes open Dependabot PRs into five groups based on a policy file in the repository. The categories are auto-merge for patch/minor bumps, escalate for majors or failed CI, close for outrun PRs, rebase suggestion for stale PRs, and skip for ongoing CI. Dry-run is the default mode, ensuring deterministic actions without relying on LLMs.

Dep-triage operates under the principle of not automating everything. It limits changes to dependency-only diffs, CI being green, and the change affecting only dependency files. If any other file is changed, the PR is not in scope. This gate ensures that only relevant changes are considered for automation.

During testing, three significant failures were encountered: GitHub's "no CI" trap, conventional-commit prefixes, and a small propagation miss. These issues highlighted the need for adjustments, such as handling empty pending statuses, accepting prefix cases, and carrying over additional flags into decision facts. After these fixes, dep-triage accurately categorized the PRs, with six auto-merge candidates, one comment rebase, and four escalations.

The major bump rule was effectively enforced, preventing dangerous automatic merges. This experience underscores the importance of real-world data testing and the need to cap automation with clear rules and checks.