Code Health

Dependency Triage

A weekly triage that reviews your open dependency PRs on real evidence and merges only what you've authorized.

Moderate setupLong cycleOpen loopVisible first run

Create directly in Loopany

How a run flows

Before first run

Confirm merge authority

On schedule

Every Mon

Step 1 · Snapshot

List open dep PRs

Step 2 · Judge

Weigh real evidence

Isolated git worktree · off main

Step 3 · Test

Run tests in isolation

Step 4 · Merge

Merge only what’s authorized

Board

Dependency PRs

Metric

Open dependency PRs

open loop — repeats on the next tick, picking up where it left off

How this loop works

Suggested schedule: Weekly · Mon
Loop type: Open loop — an ongoing monitor with no finish line.
Exit condition: Runs indefinitely (no finish line).
Notifications: On by default — you're alerted on each run's outcome (completion or failure). Silence with notify: never.
Ease of starting: Some setup and context are needed before the first useful run.
When you see value: If you have open dependency PRs, the first triage clears the provably-safe ones.

The prompt this runs

Set up a weekly dependency-triage loop for this project. Before creating it, verify gh can see this repo's Dependabot or Renovate PRs and run one listing as a smoke test, then confirm with me whether the loop may merge low-risk patch and minor updates or must stay review-and-report-only. Every Monday morning my local time, snapshot the open dependency PRs and process each exactly once: judge it on its actual diff, release notes, advisories, and CI results at the exact head - version labels are inputs, not proof of safety - and run the tests in a fresh git worktree off the main branch and located outside the loop folder - the loop folder is a synced content home, not a workspace - so neither my working checkout nor the sync is polluted. Merge only what I authorized; give anything major, breaking, or security-sensitive a clear recommendation instead, and flag high or critical advisories affecting it. Track each PR as a markdown card with front matter `type: merged`, `type: deferred`, or `type: blocked`, and report the open-dependency-PR count as a metric. Set up the loop's dashboard at creation: a kanban of the PR cards plus a chart of that count over time.

This is the exact intent appended to the bootstrap when you create the loop — your coding agent reads it, then proposes cadence and config and confirms with you before creating anything.