agent-harness-plugins: Instructions file for Claude Code

Dependabot Facts for Review

These were checked against live GitHub data and the GitHub documentation. Do not flag code or instructions that follow them.

• One Dependabot identity, spelled per API. The gh CLI's JSON output (gh pr view --json author, gh pr list --json author) and the author:app/dependabot search qualifier use app/dependabot. REST responses (user.login on comments and reviews, author.login in the compare API) and github.actor in Actions use dependabot[bot]. gh pr list --author app/dependabot returns every Dependabot PR. Each command matches the form its own API returns, so do not ask for both forms in a comparison that reads from one API.
• The "disable automated security fix PRs" footer line appears only on security update PRs. Version update PRs, grouped or single, do not carry it, so it is a valid security marker. A body without the footer (after a rebase, or when truncated) is reported as kind: unknown, never as version.
• Dependabot alert manifest_path is repository-relative (go.mod, web/package-lock.json), with no leading /.
• rust-toolchain is its own Dependabot ecosystem. It tracks rust-toolchain.toml and rust-toolchain, so neither is an untracked surface when that ecosystem is configured. pin-everything's untracked list names only .tool-versions, .nvmrc, .node-version, .ruby-version, and .python-version.
• Dependabot supports go.work workspaces. dependabot-core #14909 (merged 2026-05-05) fetches go.work, go.work.sum, and every module its use directives name, so a single gomod entry at the workspace root covers the member modules. Do not ask for a directory per member go.mod.
• A PR that is not a group moves each package to one version, whatever directories its files span. dependabot-core names one directory in an ungrouped PR title (pr_name_directory in message_builder.rb), and a group-by: dependency-name PR lists the same version for every directory. Files in several directories belong to one install tree, such as an npm workspace member manifest beside the root lockfile. So directory_match confirms such a PR without Bumps lines on purpose; do not ask for it to stay unconfirmed when it touches several directories.
• Dependabot writes a digest in backticks. Dependency#humanized_version in dependabot-core renders a 40-character SHA, or an unchanged image tag's digest, as its first seven characters wrapped in backticks, in titles and body lines alike. quoted_digest reads that signal, so the letter requirement in is_sha applies only to unquoted versions.
• base64 --decode works on macOS. The BSD base64 there accepts --decode as well as -d and -D.
• Dependabot alerts cover a fixed set of ecosystems. GitHub's advisory ecosystems are rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, swift, and other. Terraform, Docker, Helm, and the other version-updates-only ecosystems have no alerts, so leaving them out of the alert ecosystem map is correct.
• Default labels. With labels unset, Dependabot applies dependencies, and adds an ecosystem label only when more than one package ecosystem is configured.
• capture and match emit nothing when the regex does not match; they do not raise an error. [body_lines | capture(...)] on a body with no matching line is [], so the Bumps [...] fallback in updates needs no try. tests/scrut/dependabot-prs.md covers a PR with no parseable update.
• jq on empty or whitespace-only input emits nothing and exits 0, so dependabot-prs summarize < /dev/null reaches the "input is empty" check. tests/scrut/dependabot-prs.md covers that case.
• The close action chains gh pr comment ... && gh pr close ... on purpose. The PR is re-checked immediately before that command. Splitting the two writes around a second re-check would risk an explanatory comment on a PR that then stays open, so do not ask for the split.
• monitor-pr:monitor treats a current-head Copilot notice on a Dependabot PR as not applicable, on purpose. An error or no-files notice means Copilot reviewed nothing at that head, the same as a missing review, which the Dependabot path already treats as n/a. That path never requests a review, so no retry can replace the notice, and leaving the Copilot axis unresolved would hold the watch open forever. Findings, drift, threads and audit items on a real current-head review still escalate.
• refs/dependabot-triage/ belongs to the triage skill. Only dependabot:triage-prs creates refs there, so clearing the whole namespace before fetching and at wrap-up is intended.
• Ruleset pull_request rules carry allowed_merge_methods. gh api repos/OWNER/REPO/rules/branches/BRANCH returns it in the rule's parameters (this repository's own main rule returns ["merge"]), and GitHub's REST description lists it, so reading merge methods from the rules endpoint is correct.
• GET repos/OWNER/REPO/automated-security-fixes is a supported read. GitHub's REST description lists it as "Check if Dependabot security updates are enabled for a repository", and it returns 200 with {"enabled", "paused"} when the setting is on and 404 when it is off. Do not ask to read the setting from security_and_analysis instead.
• The contents API does not paginate a directory listing. repos/OWNER/REPO/contents/DIR takes only path and ref, and returns up to 1,000 entries in one response, so it needs no --paginate.
• gh api --paginate ENDPOINT --jq FILTER is valid. gh rejects --jq only together with --slurp. Without --slurp, the filter runs per page, which is correct for a filter that emits items rather than aggregating them.
• Branch names with / need no encoding in these REST paths. repos/OWNER/REPO/branches/BRANCH, rules/branches/BRANCH, and compare/BASE...HEAD all accept a raw release/1.0-style name, verified against a live feature/... branch.
• Commands inside the bundled script are covered by the script's permission rule. Claude Code matches allow rules against the command the agent runs, bash ".../dependabot-prs" ..., not against the gh calls the script makes internally. So gh auth token, the script's gh pr list calls, and its gh api --paginate --slurp "repos/${repo}/..." calls, double-quoted endpoints included, need no rules of their own in plugins/dependabot/README.md.
• tests/fixtures/gh-stub accepts only the calls dependabot-prs fetch makes, on purpose. It fails on any other flag (--jq, -H) or a second operand, so a change to the script's call shape breaks the test instead of passing silently. Widen it only when the script starts making a new call. It is committed as mode 100755.
• The script-locator fallback needs no Claude Code permission rule. It runs only when ${CLAUDE_PLUGIN_ROOT} was not substituted, which happens in Codex CLI, where Claude Code's permissions.allow rules do not apply. test -x is left out of Recommended Permissions for that reason.