Dependabot Merge

Extract for each PR: number, title, CI status (which checks passed/failed), and mergeable state.

If $ARGUMENTS is set, filter PRs whose title contains the filter string.

2. Check for Unpushed Commits

Before spawning worktree agents:

git log @{upstream}..HEAD --oneline

If unpushed commits exist, alert the user and stop. Worktree agents fork from the remote state — unpushed local commits will be missing. If no upstream is configured, use git log origin/$(git branch --show-current)..HEAD as fallback.

3. Classify PRs

Sort PRs into three groups:

Present the classification table to the user and ask for confirmation before proceeding.

4. Spawn Review Agents

For each PR, spawn a background agent in an isolated worktree:

Agent(
  isolation: "worktree",
  mode: "bypassPermissions",
  run_in_background: true
)

Agent prompt must include ALL of:

1. PR number, title, repo <owner>/<repo>
2. CI status — green or red, which checks failed
3. Mergeable state
4. Instruction to invoke review-dependency skill with the PR number as argument
5. Instruction to post a comment with findings via mcp__plugin_claudius_github__add_issue_comment (include attribution footer)
6. If Green: merge via ghsudo gh pr merge <number> --repo <owner>/<repo> --squash
7. If Red or Conflicting: do NOT merge; post @dependabot rebase comment, then enter Rebase Watch Loop (step 5a)

Spawn all agents in a single message for maximum parallelism.

5. Collect Results and Handle Write Blocks

As agents complete, check their results. Agents may be blocked from GitHub write operations by hooks. For blocked agents:

1. Post the review comment yourself using GitHub MCP
2. Execute the merge, rebase request, or watch loop yourself

5a. Rebase Watch Loop

After posting @dependabot rebase, poll until the rebase lands and CI completes (or timeout).

1. Record the current HEAD SHA before requesting rebase
2. Poll every 60s (max 15 minutes):

   gh pr view --repo <owner>/<repo> <number> --json headRefOid,statusCheckRollup,mergeable
   

3. Exit conditions:

On successful merge, report as Merged after rebase.

6. Handle Cascading Merge Failures

After earlier PRs merge, later PRs may become unmergeable (conflicting go.sum, lock files, etc.). When a merge fails with "not mergeable":

1. Post @dependabot rebase on the PR
2. Enter Rebase Watch Loop (step 5a) — same timeout and CI check logic

7. Final Report

Present a summary table:

Include:

• Total merged count (direct + after rebase)
• Rebase outcomes: merged after rebase, CI red after rebase, rebase timeout, merge failed after rebase
• Any PRs with security concerns (not merged)
• Note flaky tests if multiple PRs failed the same test

8. Lessons Learned

After completing all PRs, invoke claudius:lessons-learned skill if notable patterns emerged (flaky tests blocking merges, recurring merge conflicts, security concerns).

Attribution Footer

Every GitHub comment MUST end with:

<sub>🤖 Co-authored by [Claudius the Magnificent](https://github.com/lklimek/claudius) AI Agent</sub>

Safety Rules

• Never merge a PR with security concerns — comment only
• Never merge a PR with failing CI — request rebase instead
• Always get user confirmation before starting the bulk operation
• Use ghsudo for all write operations (merge, comment) when gh alone fails with 403/404
• If ghsudo exits with code 2 (user denied), skip that PR and move on
• If ghsudo exits with code 4 (no token), inform user to run ghsudo --setup <org>