{
  "id": 5776879,
  "title": "I automated Dependabot PR cleanup — and drew a hard line on what NOT to automate",
  "url": "https://urgent.news/2026/09/05/i-automated-dependabot-pr-cleanup-and-drew-a-hard-line-on-what-not-to",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-05T13:30:12.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sunnydachs/i-automated-dependabot-pr-cleanup-and-drew-a-hard-line-on-what-not-to-automate-4jm1"
  },
  "original_language": "en",
  "account": "GitHub's automated Dependabot PR cleanup system can be a headache, as human intervention is often required to answer the same questions repeatedly. To address this, a CLI tool called dep-triage was developed. It categorizes open Dependabot PRs into five groups based on a policy file in the repository. The categories are auto-merge for patch/minor bumps, escalate for majors or failed CI, close for outrun PRs, rebase suggestion for stale PRs, and skip for ongoing CI. Dry-run is the default mode, ensuring deterministic actions without relying on LLMs.\n\nDep-triage operates under the principle of not automating everything. It limits changes to dependency-only diffs, CI being green, and the change affecting only dependency files. If any other file is changed, the PR is not in scope. This gate ensures that only relevant changes are considered for automation.\n\nDuring testing, three significant failures were encountered: GitHub's \"no CI\" trap, conventional-commit prefixes, and a small propagation miss. These issues highlighted the need for adjustments, such as handling empty pending statuses, accepting prefix cases, and carrying over additional flags into decision facts. After these fixes, dep-triage accurately categorized the PRs, with six auto-merge candidates, one comment rebase, and four escalations. The major bump rule was effectively enforced, preventing dangerous automatic merges. This experience underscores the importance of real-world data testing and the need to cap automation with clear rules and checks.",
  "summary": "If you use GitHub, you know the rhythm: Dependabot opens a PR, CI runs green, and then a human has to answer the same questions again — is this a patch or a major? did anyone touch source code? does it conflict? I got tired of answering those questions by hand, so I built dep-triage : a CLI that sorts open Dependabot PRs into five buckets according to a policy file you commit to your repository.…",
  "key_points": [
    "Developed CLI tool dep-triage to categorize open Dependabot PRs",
    "Categorizes PRs into auto-merge, escalate, close, rebase suggestion, skip",
    "Limits automation to dependency-only diffs, green CI, dependency-file changes"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}