Skip to content

Add Dependabot upgrade verification prompt - #804

Draft
nieblara wants to merge 3 commits into
mainfrom
cursor/dependabot-verification-prompt-fb0b
Draft

nieblara wants to merge 3 commits into
mainfrom
cursor/dependabot-verification-prompt-fb0b

Conversation

@nieblara

@nieblara nieblara commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Requirements

  • I have added test coverage for new or changed functionality (N/A — prompt/docs only)
  • I have followed the repository's pull request submission guidelines
  • I have validated my changes against all supported platform versions

Related issues

n/a

Describe the solution you've provided

A reusable Cursor automation prompt for verifying Dependabot upgrades. Paste .cursor/automations/dependabot-upgrade-verification.md into the automation. The agent reads .cursor/automations/ldcli-surfaces.md for the ldcli package → surface lookup.

The prompt:

  • Forces the agent to name the CI gap before doing any extra work
  • Maps a bump onto one mode (UI computer-use, store smoke, CLI smoke, build-only, test-only, CI-only, or escalate)
  • Requires video only when a user-visible surface was actually exercised
  • Produces a structured upgrade report with an honest "signal vs CI" line
  • Treats a stale Dependabot branch as residual risk, without encoding any particular PR

The lookup table describes how this repo uses cobra, sqlite, x/term, the embedded UI, and so on. It does not name today's Dependabot queue.

Describe alternatives you've considered

  • Putting this only in a Cursor Automation and not in the repo — worse for iteration and for agents that already have the workspace.
  • Auto-approving Dependabot after a green report — out of scope; the prompt forbids merge/approve.
  • Checking in worked reports for specific PRs — those go stale as soon as the next Dependabot batch lands.

Additional context

Empty-boot UI after a dummy-token dev-server start (the store/UI playbook, not tied to a particular bump):

Empty flags page
Empty events stream
dev_server_ui_empty_flags_and_events.mp4

Open in Web Open in Cursor 

cursoragent and others added 3 commits September 18, 2026 23:49
The prompt forces a CI-gap check before any extra work, maps ldcli
dependency bumps onto CLI, store, UI, or test-only modes, and requires
video only when a user-visible surface was actually exercised.

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
The cobra branch is 36 commits behind main, and `dev-server start`
requires --access-token even for an empty local boot. Document both,
and add the dry-run report as an example of the output contract.

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
The playbooks should describe durable ldcli surfaces and modes, not
the current Dependabot queue or a one-off cobra dry-run.

Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants