What problem does it solve? Dependabot PRs pile up because each one still needs CI validation, a real-app smoke check, and a merge decision — and doing that by hand for every bump is slow and error-prone. This Skill automates the entire gate-and-merge lane for a single Dependabot PR, driving it to exactly one terminal outcome: merged, handed to a human (HITL), parked as failed, or marked superseded. ## Core Features & Use Cases - Two-tier evidence verification: Runs Tier A (CI green via /pr-watch --bot) and Tier B (a forced six-screenshot real-app tour via /verify-pr --force-tour) before any merge is approved. - Bounded fix loop with sha-keyed markers: Up to 3 fix attempts across both tiers, tracked via PR comment markers keyed to the head sha, so crashed runs resume safely and force-pushes invalidate stale verdicts. - Conflict and security handling: Retitles security bumps to fix(deps): for release-please, nudges @dependabot rebase on conflicting branches, or drives a rebase itself when agent commits exist. - Use Case: A nightly daemon triages open PRs, finds a Dependabot minor bump, and invokes this lane — it verifies CI, captures the six app screenshots, runs the decision gate, and prints a merge command for the caller to execute. ## Quick Start Invoke the skill with the PR number, branch, head sha, and reason, for example: run deps-land on PR #42 with branch dependabot/npm_and_yarn/lodash-4.17.21, the current head sha, reason dependabot, and the security and major flags from triage.
