Tune the dependency-update bot
An update bot opening more pull requests than anybody merges, grouped and scheduled so its queue is workable.
The ticket
Configure the dependency-update bot so its output is a queue the team actually works.
Acceptance criteria
- Related updates are grouped into single pull requests
- A schedule replaces continuous opening
- Auto-merge is enabled only for changes the pipeline fully verifies
- Open pull request count is recorded before and after
What lands as proof
The open pull request count before and after, which is the measure of whether the queue became workable.
Why teams defer it
- An unread queue is the same as no bot, but it still costs pipeline minutes on every push.
- Auto-merge needs confidence in the pipeline, which is a separate conversation.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: configure the dependency-update bot so its output is a queue the team actually works. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means configuration change plus the resulting queue size, measured, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.