[mortik]

Adds a /deps skill that works through the open Dependabot queue. Companion to the same skill in the other repos, but the gating here is different in kind, not just in detail.

Merging in this repo applies infrastructure. A merge to main runs Main, and a successful Main triggers Deploy, whose stage job runs terraform init → terraform plan -out=tfplan → terraform apply tfplan. The Stage environment has no protection rules, so that apply is unattended — a merged provider bump changes real infrastructure within minutes. (Live is safe: live-plan and live only run on workflow_dispatch with target: live.)

So a green check is not sufficient evidence. CI runs terraform init -backend=false, validate and test; it never plans against real state. A provider bump that changes a default, deprecates an attribute, or alters how an existing resource is read passes validate and then shows up as a change — or a replacement — in the Stage apply.

The skill therefore makes the plan the primary gate rather than CI: check out the PR, terraform workspace select stage, terraform plan, and merge only on No changes. Any must be replaced / -/+ stops the merge and gets reported with the resource addresses. If credentials for the S3 backend or the 1Password provider are unavailable, the PR is reported as unverified rather than merged on CI alone, and the report must say whether a plan actually ran.

Other repo-specific notes it encodes:

• Provider constraints in versions.tf are floors (>= 1.60), so bumps normally touch only .terraform.lock.hcl. A versions.tf change is worth reading.
• Read the version from the diff, not the title — Dependabot rewrites the branch as new releases land while the title lags. chore(deps): bump hashicorp/aws from 6.45.0 to 6.58.0 #26 is titled 6.45.0 to 6.58.0 but the diff actually moves to 6.59.0.
• bunnyway/bunnynet is on 0.x, so chore(deps): bump bunnyway/bunnynet from 0.14.1 to 0.18.0 #25 (0.14.1 → 0.17.0) is a breaking-class jump on CDN and DNS resources despite looking like a minor.
• Every open PR edits .terraform.lock.hcl, so each merge conflicts the rest — merge one at a time, watch the Stage apply, then @dependabot recreate the remainder.
• main is protected by a ruleset (terraform_test + merge queue); the classic protection API returns 404, which reads as "unprotected" if you do not know to check /rulesets.

Docs only — no Terraform changes. 🤖

[greptile-apps]

Greptile Summary

The PR adds a /deps skill for classifying and processing Dependabot provider updates in an infrastructure repository. It documents CI, Terraform planning, merge-queue handling, sequential deployment monitoring, and reporting, but leaves exceptions that weaken the intended no-op-plan gate.

• Adds repository-specific Dependabot update classification.
• Defines CI, Terraform plan, and mergeability gates.
• Documents sequential merging, Stage deployment monitoring, and failure handling.

Confidence Score: 4/5

The PR should be corrected before merging because the new skill can authorize an unattended infrastructure update without an executed plan proving that it is a no-op.

The documented workflow correctly emphasizes Terraform planning, but it exempts trivial patches and treats some non-empty plans as potentially safe, allowing real Stage changes despite the stated no-change requirement.

Files Needing Attention: .claude/skills/deps/SKILL.md

Important Files Changed

Filename	Overview
.claude/skills/deps/SKILL.md	Adds the dependency-triage workflow, but its trivial-patch exemption and acceptance of some non-empty plans undermine the required plan-clean merge gate.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Pull Dependabot queue] --> B[Classify version bump]
  B --> C{Patch or minor?}
  C -- No --> H[Hold for human decision]
  C -- Yes --> D{CI green?}
  D -- No --> H
  D -- Yes --> E[Run Stage Terraform plan]
  E --> F{Exactly No changes?}
  F -- No or unavailable --> H
  F -- Yes --> G[Enqueue merge]
  G --> I[Wait for and inspect Stage apply]
  I --> J{Apply successful?}
  J -- No --> K[Stop and recommend revert]
  J -- Yes --> L[Recreate remaining Dependabot PRs]

Loading

_{Reviews (1): Last reviewed commit: "chore(skills): add deps triage skill" | Re-trigger Greptile}

[greptile-apps]

Plan gate permits infrastructure changes

When an update is considered a trivial patch or its plan contains changes interpreted as optional defaults, this workflow permits it to proceed without a plan reporting No changes., causing unexpected infrastructure changes during the unattended Stage apply.