cy0307/awesome-loop-engineering

1# Dependency Triage Loop2 3## Objective4 5Classify dependency updates into safe patches, deferred upgrades, or human-review items with reproducible evidence.6 7## Trigger8 9- Schedule: weekly or after dependency bot activity.10- Event: Dependabot, Renovate, package manager advisory, or lockfile update PR.11- Manual bootstrap/debug command: "triage dependency updates for this repository."12 13## Intake14 15- Dependency update PRs, release notes, changelogs, advisories, lockfile diff, package manager audit output, and affected package usage.16- Repository compatibility policy and supported runtime versions.17- Recent CI status and known flaky tests.18 19## Agents20 21- Classifier: groups updates by risk, security relevance, semantic version change, and blast radius.22- Implementer: applies low-risk updates or patches lockfile conflicts.23- Verifier: runs targeted tests, typechecks, builds, and package manager audits.24- Reporter: records accepted updates, deferred updates, and human-review reasons.25 26## Workspace And Permissions27 28- Use a clean branch or worktree per update group.29- Allow package manager commands, tests, typechecks, and build commands.30- Disallow broad dependency upgrades, runtime-version changes, migration rewrites, or security-policy changes without human approval.31 32## Durable State33 34- Processed update IDs, package versions, changelog links, commands run, verification output, deferred reasons, and reviewer questions.35 36## Loop Steps37 381. Discover dependency PRs, advisories, or stale dependency groups.391. Load repository compatibility rules and prior triage state.401. Delegate risk classification, patching, verification, and reporting.411. Split updates into safe patch, minor feature, major migration, security, and blocked groups.421. Apply only the safe group automatically.431. Run targeted tests, typechecks, build, and audit commands.441. Persist evidence and open or update PR comments.451. Repeat for the next safe group or escalate.46 47## Verification Gates48 49- Lockfile and package manifest are consistent.50- Relevant tests, typecheck, build, and package audit pass.51- Release notes or changelogs do not indicate required migration steps that were skipped.52- Diff is limited to the intended dependency group.53 54## Budget And Exit55 56- Max retries: 2 patch attempts per dependency group.57- Max runtime: 60 minutes per scheduled run.58- Stop when safe updates are merged or ready for review, risky updates are deferred with reasons, or verification fails repeatedly.59 60## Escalation61 62Escalate for major version upgrades, runtime requirement changes, security advisories with product impact, migration code, licensing concerns, or repeated verification failures.63 64## Loop Instruction65 66```text67Triage dependency updates for <repository>.68Group updates by risk and apply only narrow, low-risk changes automatically.69Run the smallest relevant verification commands and package audit.70Record changelog links, commands, passing evidence, deferred updates, and escalation reasons.71Do not perform major migrations or runtime changes without human approval.72```73 74Example automation: run weekly and on dependency bot PR creation, then comment with accepted, deferred, and escalated update groups.75 76## Failure Modes77 78- Bundling unrelated upgrades into one large diff.79- Ignoring runtime or peer dependency constraints.80- Treating a security advisory as fixed without verifying the vulnerable path.81- Updating generated lockfiles without a reproducible package manager command.82 83## References84 85- [GitHub Agentic Workflows](https://github.github.com/gh-aw/) - Event or schedule triggered repository automation with guardrails.86- [OpenAI Agents SDK human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals) - Approval boundaries for sensitive tool actions.87