---
name: sd-update-deps
description: Use when open dependency-bot PRs need batch triage — classify every dependabot or renovate PR, merge the safe class sequentially under the housekeeping gate criteria, and park the rest with one-line recommendations.
model: sonnet
---

# SD Update Deps

Run this project-local skill for `sd-update-deps` and `/sd:update-deps` style
work. It batch-triages the open dependency-bot pull requests in the current
repository: classify every PR, merge the safe class strictly sequentially
under the housekeeping gate criteria, and park everything else with a
one-line recommendation.

This command triages and merges; it does not upgrade dependencies itself. It
never edits dependency manifests or lockfiles, never pushes to bot branches,
and never opens PRs of its own. The housekeeping gate criteria are the merge
authority: this skill adds no second merge path with weaker criteria.

## Sandbox-safe tool execution

Run every `gh`, `uv`, `pip`, `ruff`, or `npm` command shown in this workflow
through `bash "$SD_PACK_TOOLCHAIN" run -- <tool> [args...]`, with
`$SD_PACK_TOOLCHAIN` resolved by the bootstrap in
[`../sd-help/references/pack-helper-resolution.md`](../sd-help/references/pack-helper-resolution.md).
The argv-safe wrapper changes only documented cache variables and preserves
auth/config state. If it is missing or reports a cache-setup failure, stop with
that diagnostic; do not retry the tool bare or redirect `GH_CONFIG_DIR`.

## When to use

Run this command when dependency-bot PRs have accumulated and the user wants
one batched triage pass instead of PR-by-PR manual decision rounds.

- Scope: open PRs in this repository authored by dependency bots —
  `dependabot` and `renovate`, including their `[bot]` account forms.
- Human-authored PRs are out of scope. Leave them to `sd-review-pr` and
  `sd-housekeeping`.
- Red dependency PRs are parked, not fixed here. Recommend `sd-fix-ci` for
  the ones worth rescuing.
- One repository per run: the current checkout's GitHub repository.
- Positioning: `sd-housekeeping` wraps up one stream's own ready PR; this
  command applies the same merge criteria across the dependency-bot
  backlog. Neither replaces the other.

## Arguments

Arguments arrive as free text with the invocation, as `key=value` pairs and
bare flags. Unknown argument names are an error, not a silent skip: stop and
report them before touching any PR. This skill reads no environment
variables; every tuning knob is an argument.

- `include-runtime-minor` — bare flag. Add runtime-dependency minor updates
  to the auto-merge class for this run. Off by default: without it, runtime
  minors are parked for manual review.
- `dry-run` — bare flag. Classify and emit the full report only; perform no
  merges and no other mutations.

## Workflow

1. Enumerate. List open PRs with `gh pr list` and keep only dependency-bot
   authors. Zero matching PRs is a valid result: report it and stop.
2. Classify every dependency PR on four axes:
   - ecosystem — npm, pip, GitHub Actions, and so on, read from the bot
     metadata and the changed manifest files;
   - semver delta — patch, minor, or major, read from the title and diff;
   - security-advisory linkage — dependency bots flag security updates and
     link the advisory in the PR body or labels;
   - dependency kind — development-only or runtime, read from the manifest
     section the PR changes.
3. Assign each PR exactly one class:
   - Auto-merge class: patch and minor dev-dependency updates, GitHub
     Actions SHA and pin bumps, and security patches.
   - Runtime-dependency minors join the auto-merge class only when
     `include-runtime-minor` was passed.
   - No flag adds a major version update to the auto-merge class —
     majors are always manual.
   - Everything else is parked.
4. With `dry-run`: emit the final report from the classification and stop
   here. No merges, no mutations of any kind.
5. Process the auto-merge class strictly sequentially, one PR at a time:
   1. Start from the clean synchronized default branch and delegate the one
      merge attempt to the installed housekeeping owner:

      ```bash
      SD_PACK_TOOLCHAIN=""
      for candidate in "${SD_AI_COMMAND_PACK_TOOLCHAIN:-}" \
        "scripts/sd-ai-command-pack-toolchain.sh" \
        "$HOME/.agents/bin/sd-ai-command-pack-toolchain.sh"; do
        if [ -f "$candidate" ]; then SD_PACK_TOOLCHAIN="$candidate"; break; fi
      done
      [ -n "$SD_PACK_TOOLCHAIN" ] || { printf '%s\n' "error: sd-ai-command-pack toolchain not found; checked SD_AI_COMMAND_PACK_TOOLCHAIN, scripts/, and \$HOME/.agents/bin. Reinstall the command pack." >&2; exit 1; }

      bash "$SD_PACK_TOOLCHAIN" run -- sd-ai-command-pack-housekeeping.sh --dependency-pr <number>
      ```

      Housekeeping invokes the shared schema-versioned PR eligibility
      evaluator in `dependency-pr` mode, re-reads the exact PR head after
      checks and complete review-thread pagination, and performs the only
      `gh pr merge --match-head-commit` mutation. Do not reconstruct checks,
      thread, head, or mergeability logic in this skill.
   2. Treat an `eligible` receipt plus housekeeping's confirmed merge and
      clean default-branch report as success. If the evaluator returns
      `blocked` or `indeterminate`, or GitHub refuses the merge, park that PR
      with the stable diagnostic from housekeeping.
   3. Re-enumerate the remaining open dependency PRs after every successful
      merge. Dependency bots may rebase when the default branch moves, so an
      earlier receipt is never evidence for a later attempt.
   4. A red or unclean default branch stops the merge loop. Report all
      remaining auto-class PRs as parked pending a clean green default branch.
6. Park everything outside the merged set with one line per PR: the PR
   reference plus a concrete recommendation. Examples:
   - `major — review the changelog and migration notes manually`
   - `runtime minor — rerun with include-runtime-minor after review`
   - `red CI — triage with sd-fix-ci`
   - `unresolved review thread — resolve with the author, then rerun`

## Safety rules

- Sequential merges only. Never merge dependency PRs in parallel, and never
  bypass the shared evaluator or housekeeping's default-branch verification.
- Never merge red, commented, or behind PRs.
- Never auto-merge a major version update, with or without flags —
  majors are always manual.
- Housekeeping is the only merge mutation owner. This skill must not invoke
  `gh pr merge`, restate readiness logic, weaken an evaluator result, or force
  a merge that GitHub refuses.
- Never dismiss reviews or resolve other people's review threads to make a
  PR look comment-clean.
- Never edit dependency manifests, lockfiles, or bot branches. This skill
  triages and merges; it does not write code.
- `dry-run` performs no mutations of any kind.

## Final report

The final report is mandatory-shaped: every item below appears in every run,
and an empty item states its emptiness explicitly (write `none`). Keep it
scannable — bullets and short lines, one point per line, no paragraph blobs.

- Classification table: one row per dependency PR —
  PR · ecosystem · delta · class. Class is one of `auto-merge`,
  `manual (major)`, or `parked`.
- Merged list: the PRs merged this run, in merge order, or `none`.
- Parked list: every non-merged PR with its one-line reason or
  recommendation, or `none`.
- Default-branch status: green after the final merge, or the failing checks
  by name.

With `dry-run`, the classification and parked items carry the report;
state Merged as `none` and the default-branch status as currently observed.

Example shape for a mixed run:

```
- Classification:
  - #101 · npm · patch · auto-merge
  - #102 · GitHub Actions · pin bump · auto-merge
  - #103 · pip · minor · parked
  - #104 · npm · major · manual (major)
- Merged: #101, #102 (sequential; default branch green after each)
- Parked:
  - #103 — runtime minor; rerun with include-runtime-minor after review
  - #104 — major; review the changelog and migration notes manually
- Default branch: green
```