Slim down dependabot triage comments - #14019
Merged
williammartin merged 2 commits intoJul 31, 2026
Merged
Conversation
Replace the old merge-confidence framing with separate recommendation and confidence axes. Tighten the posted output to dense prose and add coverage-gap guidance while preserving the literal head-SHA dedup marker. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 92242e78-0b8a-4abc-9481-094c4090893e
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refines the dependabot-triage agentic workflow’s posted assessment comment to remove redundant metadata and focus on actionable maintainer guidance: a recommendation + confidence line followed by concise prose grounded in upstream changes, with richer evidence linking and new coverage-gap surfacing.
Changes:
- Updates the workflow/skill contract from a single “merge-confidence” axis to independent Recommendation and Confidence axes.
- Replaces the previous “key facts”/metadata-heavy output with a strict prose-based comment format, including explicit link-generation rules and a dedup-marker carve-out.
- Regenerates the compiled workflow lock metadata to reflect the updated markdown sources.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/dependabot-triage.md | Updates workflow description and step wording to align with the new recommendation+confidence assessment model. |
| .github/workflows/dependabot-triage.lock.yml | Refreshes generated hashes and embedded description strings produced by gh aw compile. |
| .github/skills/dependabot-triager/SKILL.md | Redefines the output contract and rubric (two-axis model), adds coverage-gap guidance, and tightens link/format rules while preserving dedup behavior. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Lite
A recommendation is emitted, not assessed. The old text read 'assesses a merge-confidence level', where the verb fit; swapping in 'recommendation' kept the verb and inverted the meaning. Match the skill frontmatter's 'emits', and use 'decide' for the two step headings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 92242e78-0b8a-4abc-9481-094c4090893e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The
dependabot-triageagentic workflow posts a merge-assessment comment on every open Dependabot PR. The comment it produces today is mostly padding: it restates the dependency name, the from/to versions, the semver label, and the ecosystem, all of which are already in the PR title, plus CI status that is visible on the PR page and a "compatibility score" line that reports only that Dependabot's badge exists.Here is a representative example. Of the eight facts it lists, one is genuinely useful: the summary of what changed upstream.
This changes the output so it replaces the work a maintainer actually does when verifying a bump, rather than narrating metadata already on screen. The comment becomes a recommendation line plus prose, and nothing else:
Three substantive changes came out of the rewrite rather than just deleting bullets.
The two axes are now independent. The old rubric folded CI status into confidence: "failing CI caps confidence at Low". That is backwards. If CI is reproducibly red, you are highly confident the PR should not be merged. Recommendation (
Merge/Review before merging/Do not merge) now answers what the maintainer should do and is driven by risk; confidence answers how sure the agent is and is driven purely by evidence quality. That makesDo not merge, Confidence: HighandReview before merging, Confidence: Lowboth expressible, where previously they would have collapsed into the same "Low".Coverage analysis is new. The skill now maps changed upstream behavior to this repository's usage and to the tests and CI jobs that exercise it, and names the specific missing scenario when there isn't one. It is surfaced only when a material gap exists, so silence means no gap was found.
References become real links. Commits, releases, files, and advisories are emitted as markdown links built from data actually fetched through the GitHub MCP tools, so a reviewer can click through to the evidence.
Authorship and follow-up
Who wrote this:
Who answers review comments: