deps
Enumerates automation PRs (renovate / dependabot etc.) with the `deps.mjs` engine and makes fixed-vocabulary judgments based on semver classification (from PR title / branch / manifest diff; grouped PRs use the maximum bump), CI status, lockfile consistency, and peer / engines changes. patch/minor + CI green + lockfile consistent → auto-merge candidate; major / CI red / pending / peer / engines → 要確認. Author judgment uses the same pattern as health area 15 (`*[bot]` / `app/*`; release-please is excluded — that's `/release`'s responsibility). `--dry-run` judges only; `--auto` executes without confirmation. Merging follows the central autonomy policy's irreversible gate (`--auto` overrides the policy).
- License 许可
- MIT
- 所属仓库
- ozzy-labs/skills
- 最近更新
- 2026-07-13
- Stars
- ★ 0
- Forks
- 0
01 前言 Front Matter
- description
- Enumerates automation PRs (renovate / dependabot etc.) with the `deps.mjs` engine and makes fixed-vocabulary judgments based on semver classification (from PR title / branch / manifest diff; grouped PRs use the maximum bump), CI status, lockfile consistency, and peer / engines changes. patch/minor + CI green + lockfile consistent → auto-merge candidate; major / CI red / pending / peer / engines → 要確認. Author judgment uses the same pattern as health area 15 (`*[bot]` / `app/*`; release-please is excluded — that's `/release`'s responsibility). `--dry-run` judges only; `--auto` executes without confirmation. Merging follows the central autonomy policy's irreversible gate (`--auto` overrides the policy).
- allowed-tools
- Bash, Read, AskUserQuestion
- argument-hint
- [--repo owner/repo] [--limit N] [--dry-run | --auto]
- disable-model-invocation
- true
02 资源文件 1
- 脚本deps.mjs29.9 KB
03 SKILL.md 正文
deps
Read .agents/skills/deps/SKILL.md and follow its workflow steps.
Important: All determinism (automation PR enumeration / author determination / semver classification / CI judgment / lockfile consistency / peer & engines detection / the fixed-vocabulary judgment table / merge execution) is handled by the bundled deps.mjs engine. The SKILL confines itself to the judgment layer: "call the engine, present its output as-is, and confirm merges via the policy gate." Claude does not merge based on its own judgment that it "looks safe" (the judgment is determined by the engine's fixed vocabulary).
Claude Code-specific additions
Running the engine
node ~/.claude/skills/deps/deps.mjs [--repo owner/repo] [--limit N] [--dry-run | --auto]
For dogfooding (within this repo), it's <repo>/.claude/skills/deps/deps.mjs. Output is formatted text (structured JSON with --json). Pass the user's input through as the arguments.
--repo owner/repo: if omitted, the engine extracts it fromgit remote get-url origin--limit N: enumeration limit (default 50)--dry-run: judge only. No merge, no confirmation--auto: merge without confirmation (an explicit opt-out of the irreversible gate)- If
--dry-runand--autoare both specified, the engine prioritizes--dry-run(to prevent accidental merges)
Merge confirmation (policy's irreversible gate = ask)
When neither --dry-run nor --auto is specified (plan mode), the engine does not merge and instead returns a merge_plan (the scheduled gh pr merge <N> --squash) and the auto-merge candidates. Since merging is an irreversible action, it follows the policy's gate. Look up the gate with policy-read.mjs --action=merge --repo-root="$PWD" (user-scope: ~/.claude/skills/policy/policy-read.mjs; dogfood: <repo>/.claude/skills/policy/policy-read.mjs).
- gate=
ask(zero-config default): confirm auto-merge candidates one at a time via AskUserQuestion (do not enumerateY/nas text). Only approved PRs getgh pr merge <N> --squashexecuted (the corresponding command frommerge_plan). The要確認group is not merged; it is only presented with reasons - If loosened to gate=
batch-confirm: present auto-merge candidates together once and confirm them all via AskUserQuestion → if approved, re-rundeps.mjswith--autoappended to the same arguments - gate=
proceed: re-run with--autowithout confirmation
When --auto is specified, AskUserQuestion is not inserted (an explicit opt-out of the irreversible gate). The engine merges serially, noting the result (merge_results) alongside each row.
Integration with scheduled execution
Launching in the form /deps --auto from schedule (cron routine) or /loop closes the loop of "consume automation PRs every morning" (ADR-0028 R5). Since AskUserQuestion cannot be inserted during scheduled execution, the engine's conservative judgment table (要確認 when in doubt) and the policy gate become the sole boundary.
Completion report and next-action suggestions
End once the triage table / merged PRs / 要確認 breakdown have been displayed. Do not suggest next actions.
04 同仓库更多 Skills
verify
An integrated skill that runs the combined validation of build / typecheck / test / lint in one shot. The `verify.mjs` engine auto-discovers validation commands via a discovery chain (AGENTS.md's 「検証」 section → package.json scripts → justfile/Makefile/lefthook → language heuristics), executes them serially with their source attached, and returns a result summary. If a higher-priority stage produces a hit, only that stage is executed (no crossing stages).
usage-guard
Monitors Claude Code's Usage Limit (5-hour = Current / weekly = Weekly), pauses work when it exceeds 95%, and automatically resumes once the reset restores headroom. Bundles an engine form that a caller such as drive Reads at a checkpoint, and a standalone form, `/usage-guard "<continuation command>"`, that guards arbitrary work. Claude-only (depends on the OAuth usage-rate endpoint + ScheduleWakeup).
topics
Selects GitHub topic candidates by having the `topics.mjs` engine perform constraint validation, popularity measurement, broad+narrow / singular-plural comparison, and hardcoded ozzy-labs conventions, then applies them via `gh repo edit --add-topic` following the policy's `externally-visible` gate (default batch-confirm). Scope is limited to use within ozzy-labs.
skill-observability
Defines the skill observability event contract (event.schema.json) and emit substrate (obs-emit.mjs). The SSOT for the measurement layer of the skill improvement loop. Referenced by other skills and hooks.
skill-metrics
Aggregates the local observability event log (~/.agents/observability/events.jsonl) and presents, read-only, per-skill invocation counts and notable events (fallback / HITL rejection / loop cap reached / abort). Fires on "show me the skill metrics," "aggregate the observability results," "which skills get used the most?" Does not send anything.
ship
Runs verification, commit, and PR creation all at once. An integrated pipeline that runs verify (build + type + test + lint) → commit → PR creation in sequence against the changes.