Teach the Dependabot reviewer what this repo actually reports

[DeDuva]

Adds .github/prompts/dependabot-review.md — the prompt a weekly Claude routine runs to triage, validate, and merge Dependabot PRs — plus a pointer to it in CLAUDE.md.

It is written against this repository rather than a generic npm project, because the generic version is unsafe here. Each rule below was checked against the 14 currently-open Dependabot PRs.

What a generic reviewer gets wrong here

mergeStateStatus: CLEAN is not evidence. Every substantive job in squad-ci.yml is gated behind needs: changes and an if:, so a PR can report CLEAN while test was skipped or cancelled. Observed right now:

PR	Reported	Actually
#112	MERGEABLE / CLEAN	only test run was CANCELLED; npm ci on its head exits 1
#55	MERGEABLE / CLEAN (before this PR)	Astro 6→7 major with no substantive check ever run
#111	MERGEABLE	test and sdk-exports-validation both FAILURE

The prompt requires a named SUCCESS from a check that exercised the changed paths, and treats SKIPPED and CANCELLED as the absence of a result rather than a pass.

Workspace lockfile drift. Dependabot sometimes bumps a workspace member's package.json without touching the root package-lock.json. npm ci then refuses to install and the PR's green CI is green for the old versions. Confirmed by running npm ci on #112's head:

npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json ... are in sync.
npm error Missing: esbuild@0.28.2 from lock file

#111 and #26 are in the same state. All three report MERGEABLE.

Three ecosystems, not one. Five open PRs are NuGet and one is github-actions. Each gets its own expected-paths list; action bumps get extra scrutiny, since the upgraded thing runs with the workflow token.

npm run check, not npx vitest run. The latter skips the lint and check:docs passes — exactly what a TypeScript or tooling bump breaks.

Companion change to the repo (already applied)

The default-branch ruleset existed but was set to enforcement: disabled, so dev was unprotected. It is now active, with claude-md and changes as required status checks — the only two jobs here that run unconditionally, so requiring anything deeper would block PRs that legitimately skip it. Repository auto-merge is now enabled so the routine can queue merges behind checks instead of merging directly.

Effect: #90 stays CLEAN; #55 correctly flipped to BLOCKED.

Protection here proves a PR is fresh and well-formed — not that the update was tested. The prompt says so explicitly and does not treat the required-checks list as validation.

Validation

• npm run check:docs passes with the new CLAUDE.md reference.
• Prompt exercised end-to-end in report mode over all 14 open Dependabot PRs.
• Local validation path tested on deps: bump the minor-patch group across 1 directory with 5 updates #90: npm ci clean, lockfile untouched, npm run build green.
• Lockfile-drift rule tested on deps: bump esbuild from 0.25.12 to 0.28.2 in /packages/squad-cli in the minor-patch group across 1 directory #112: reproduces the EUSAGE failure above.

Of the 14 open PRs, exactly one (#90) reaches SAFE_TO_MERGE.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 9e91c52

PR Scope: 🔧 Infrastructure

⚠️ 2 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
✅	CI passing	All checks passing

Files Changed (2 files, +512 −0)

File	+/−
.github/prompts/dependabot-review.md	+503 −0
CLAUDE.md	+9 −0

Total: +512 −0

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[github-actions]

🟡 Impact Analysis — PR #132

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	2
Files added	1
Files modified	1
Files deleted	0
Modules touched	2

🎯 Risk Factors

• 2 files changed (≤5 → LOW)
• 2 modules touched (2-4 → MEDIUM)

📦 Modules Affected

ci-workflows (1 file)

• .github/prompts/dependabot-review.md

root (1 file)

• CLAUDE.md

---

This report is generated automatically for every PR. See #733 for details.