48 skills · sorted by relevance
Configure GitHub Dependabot to keep dependencies, the packages a project relies on, updated. Organize update pull requests into groups, set schedules and exclusion rules, and configure security updates across projects with multiple packages or package systems.
dependabot 設定（.github/dependabot.yml）の新規作成・整備。リポジトリから ecosystem を自動検出し、lockfile コンフリクトを避ける group 設計と security fast-track を備えた設定を生成する。dependabot 設定の作成・見直し・追加の依頼時、/setup-dependabot 実行時に使用。境界: Renovate は対象外。dependabot が作った PR の対応は pr-review 等の通常フロー。
The English summary is being prepared. Showing the original description.
Complete a Dependabot update across a monorepo by updating matching dependency versions in other packages and regenerating bun.lock. Check the changed files, preserve existing version prefixes, then commit and push the fixes.
Reviews open Dependabot PRs, classifies by risk (patch/minor/major, security, lockfile-only), and merges safe ones or advises on what to do. Use when user mentions "dependabot", "dependabot PRs", "dependency updates", "merge dependabot", "review dependabot", "dependency PRs", "bump PRs", "update dependencies", or runs /dependabot-review command.
The English summary is being prepared. Showing the original description.
Collect open Dependabot alerts, group them by dependency files, and propose fixes suited to each package manager. After approval, update dependency versions or override settings and verify that patched versions are installed without introducing new audit issues.
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.
The English summary is being prepared. Showing the original description.
Operational guide for the NV oOS Dependabot alert triage-and-remediation loop: querying open alerts via gh api, separating stale from genuinely vulnerable lockfile entries (default-branch forensics), deciding between safe in-major override bumps, scoped overrides, or deferred major migrations (npm pack signature diffing), regenerating the 13-lockfile tree, dismissing alerts with the right reason, GitHub issue housekeeping, and triaging the known CI failure modes. Use when asked to fix dependabot alerts, close out dependabot issues, bump vulnerable npm packages, or resume a dependabot session.
The English summary is being prepared. Showing the original description.
Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot.
The English summary is being prepared. Showing the original description.
GitHub Actions の SHA ピン留め（pinact 必須）と Dependabot・Renovate のクールダウン設定（14日間）をリポジトリに適用し、サプライチェーン攻撃対策を実施する。ユーザーが「サプライチェーン対策」「GHA ピン留め」「Dependabot クールダウン」「pinact」「supply chain hardening」に言及した場合に使用する。
The English summary is being prepared. Showing the original description.
Check third-party packages for known security vulnerabilities, review dependency versions and lock files, and plan updates or replacements. The skill also guides automated scanning in CI, the pipeline that runs project checks.
Plan and carry out major library and framework upgrades by checking compatibility, identifying changes that require code updates, testing each stage, and preparing rollback steps if an upgrade causes problems.
Use when triaging, classifying or landing Dependabot pull requests in this repo — clearing the open Dependabot queue, deciding whether a bump needs a WW Jira ticket, or checking whether a bump's build actually passed.
The English summary is being prepared. Showing the original description.
Processes all open Dependabot PRs sequentially — rebases if needed, analyzes for breaking changes and security issues, then merges or requests changes. Use when you want to handle pending Dependabot dependency updates.
The English summary is being prepared. Showing the original description.
指定されたPR番号のDependabot PRを確認し、依存ライブラリのバージョンアップ内容をCHANGELOGとcontext7から取得して、コード修正が必要かを判定します。修正が必要な場合は修正を行い、pushまで実施します。
The English summary is being prepared. Showing the original description.
Use when working with Dependabot — dependabot and Renovate dependency update management. Covers vulnerability alerts, dependency update PRs, auto-merge configuration, version pinning, update scheduling, and security advisory tracking. Use when managing dependency updates, reviewing vulnerability alerts, configuring auto-merge policies, or auditing dependency health.
The English summary is being prepared. Showing the original description.
指定されたPR番号のDependabot PRを確認し、依存ライブラリのバージョンアップ内容をCHANGELOGとcontext7から取得して、コード修正が必要かを判定します。修正が必要な場合は修正を行い、pushまで実施します。
The English summary is being prepared. Showing the original description.
Manage GitHub repository operations with the gh command-line tool. Classify issues, check pull request readiness, investigate failed automated checks, prepare releases and changelogs, and review dependency or exposed-secret security alerts.
Update GitHub Actions when workflow logs warn about deprecated runtimes. The skill guides compatible version selection, pins actions to exact commits, preserves existing workflow behavior, and checks execution results and outputs after the upgrade.
Read-only audit of a GitHub repository's security posture. Gathers ref protection (rulesets AND classic branch protection), Actions token permissions, code and supply-chain features (Dependabot, secret scanning, push protection, CodeQL), and repo hygiene toggles via `gh api`, then classifies findings against essential / recommended / advanced tiers into a PASS/GAP report. Makes NO changes. Use when reviewing a repo before open-sourcing or a release, auditing a public user-owned repo whose CI auto-commits to the default branch, verifying a hardening change actually took effect, or producing a baseline security posture report for a repository.
The English summary is being prepared. Showing the original description.
Fix a Dependabot PR by updating all monorepo instances of the dependency, running bun install, and pushing
The English summary is being prepared. Showing the original description.
ライブラリ更新pull requestのレビュー。 dependabotやrenovatebotが作成したPR、または手動で作成されたライブラリ更新PRをレビューし、 release note分析、コード更新、依存関係調査、過去の失敗調査を行う。
The English summary is being prepared. Showing the original description.
Review Dependabot PRs efficiently: triage, risk assessment, batching, and auto-merge policies. Use when dependency update PRs pile up or you want a sane update workflow.
The English summary is being prepared. Showing the original description.
Triage and fix Dependabot alerts and CodeQL findings in the ai repository. Use when the user asks to address security vulnerabilities, fix Dependabot alerts, resolve CodeQL issues, or do security maintenance.
The English summary is being prepared. Showing the original description.
プロジェクトの定期点検（健康診断）。「健康診断して」「ヘルスチェックして」「プロジェクトの状態を確認して」「最近ほったらかしだったので点検して」といった依頼で発動する。放置されると危険が積み上がる項目——Dependabotの更新PR、セキュリティアラート、CIの失敗、依存パッケージの脆弱性、古い作業ブランチ、未コミットの変更——をまとめて棚卸しし、優先度付きで報告する。エンジニアが常駐しないチームでは週1回の実行を推奨する運用にしており、担当者が何も覚えていなくても「健康診断して」の一言で点検が回ることを目的とする。
The English summary is being prepared. Showing the original description.