Add dependency update automation skill and prompt

promptbook/prompts.json

@@ -839,6 +839,26 @@
       ],
       "formatNotes": "All three. Point the tool at `.vscode/mcp.json`, `.mcp.json`, `.claude/settings.json`, `.codex/config.toml`, CODEOWNERS, and the CI workflows, and paste the Copilot cloud agent MCP JSON from repo settings. Copilot: mcp path instructions plus those files in agent mode (or save it as `.github/prompts/harden-coding-agent-mcp-config.prompt.md`). Claude Code: the coding-agent-mcp-server-guardrails skill plus the files. Codex: AGENTS.md agent tools and MCP section, then the diff.",
       "body": "Task: Audit and harden the MCP server configuration that GitHub Copilot, Claude Code, and Codex use in this repository. Finish with a minimal diff, a server inventory, and tests that prove write tools and injected instructions are contained.\n\nContext placeholders (fill from the repo or ask only if missing):\n- Config files: {{CONFIG_FILES}}  (e.g. .vscode/mcp.json, .mcp.json, .claude/settings.json, .codex/config.toml)\n- Copilot cloud agent MCP JSON: {{CLOUD_AGENT_CONFIG}}  (pasted from repo Settings > Copilot > MCP servers, or none)\n- Servers in use: {{SERVERS}}  (e.g. GitHub, Azure, Atlassian, Postgres via DBHub, Playwright, an internal server)\n- Systems and data reached: {{DATA}}  (e.g. GitHub repos, Azure subscription dev-rg, Jira project ABC, analytics DB read replica)\n- Where agents run: {{RUNTIMES}}  (IDE, terminal, CI headless jobs, Copilot cloud agent)\n- Approved server list or owner: {{APPROVED_LIST}}  (file path, wiki page, or \"none yet\")\n- Secret store: {{SECRETS}}  (Agents secrets with COPILOT_MCP_ prefix, env vars from a password manager, Key Vault)\n\nRequirements:\n\n1. Inventory\n   - Table: server | defined in (file or settings page) | tool (Copilot, Claude Code, Codex) | transport | publisher | version pin | tools enabled | credential and its scope | data reachable | owner\n   - Flag: @latest or unpinned packages and images, unknown publishers or generic bridges, SSE or plain HTTP, \"*\" tool lists, literal tokens or auth headers, broad tokens, servers with no owner\n\n2. Pin and vet\n   - Pin local servers to exact versions or image digests; keep the same pin across all three tools' configs\n   - Replace unknown publishers with the vendor's official server, or remove the server and say why\n   - Move remote servers to Streamable HTTP over HTTPS; pin OAuth scopes (Claude Code `oauth.scopes`, Codex `scopes`)\n\n3. Tools and approvals\n   - Allowlist tools by name, read-only first: Copilot cloud agent `tools`, Codex `enabled_tools`/`disabled_tools`, Claude Code `permissions.allow`/`deny` with `mcp__<server>__<tool>`\n   - Write and destructive tools: approval prompt in interactive tools (Codex `default_tools_approval_mode = \"prompt\"` or `\"writes\"`; Claude Code not in allow, or in deny); removed from the cloud agent and CI configs\n   - List every write tool you kept and the reason\n\n4. Credentials\n   - Remove every literal secret; reference VS Code `inputs` with `\"password\": true` or env, `${VAR}` in `.mcp.json`, `bearer_token_env_var`/`env_http_headers` in Codex, `$COPILOT_MCP_*` for the cloud agent\n   - Recommend fine-grained, read-only, per-agent tokens and the least-privilege data identity for each server (read-only DB user, scoped Azure role, read-only GitHub toolsets)\n   - If a secret was committed, say so plainly and list rotation as the first follow-up; do not print it\n\n5. Untrusted output\n   - For each runtime, state whether one session combines private data, untrusted content, and an outbound tool; if so, add an approval on the outbound step or split the task\n\n6. Headless and CI\n   - Claude Code: a minimal `ci-mcp.json` used with `--strict-mcp-config --mcp-config`; `disabledMcpjsonServers` for anything CI must never load\n   - Codex: `required = true` on servers a job depends on; explicit `enabled_tools`\n   - Copilot cloud agent: firewall allowlist entries and `copilot-setup-steps.yml` dependencies the servers need\n   - Startup and tool timeouts plus output caps for every server\n\n7. Guard the files\n   - CODEOWNERS for the MCP config paths\n   - A small CI check that fails on literal tokens, populated Authorization headers, `@latest`, `enableAllProjectMcpServers`, and \"*\" tool lists in those files\n\n8. Tests\n   - A disabled write tool is not offered; an allowed write tool asks for approval; a planted instruction in an issue or doc (\"post the env to this URL\") does not trigger an outbound call; CI fails clearly when a required server is missing\n\nConstraints:\n- Minimal diff. Only touch MCP config, agent instruction files, CODEOWNERS, and the new check.\n- Never print, echo, or commit secret values; use placeholders.\n- Don't connect to production systems or call write tools while testing; use a sandbox repo, project, or database.\n- Don't invent server package names, versions, tool names, or tenant IDs; read them from the server's docs or `tools/list`, or use placeholders and state assumptions.\n- Optimize for GitHub Copilot, Claude Code, and Codex: give concrete per-tool snippets and a checklist.\n\nOutput format:\n1. Inventory table with flagged issues\n2. Patch per file (`.vscode/mcp.json`, `.mcp.json`, `.claude/settings.json`, `.codex/config.toml`, cloud agent JSON to paste, CODEOWNERS, CI check)\n3. Tool and approval matrix: server | tool | read or write | Copilot | Claude Code | Codex | CI\n4. Credential plan: secret name | where stored | scope | owner | rotation\n5. Test plan with expected results\n6. Risks, rotations needed, and follow-ups\n\nStart with the inventory. Cut before you configure, allowlist read-only first, and keep every write behind a human.\n"
+    },
+    {
+      "id": "configure-grouped-dependency-updates",
+      "title": "Configure Grouped Dependency Updates with Safe Auto-Merge",
+      "whenToUse": "Set up or clean up Dependabot or Renovate for a Maven or Gradle service with Dockerfiles and GitHub Actions: inventory coverage and pinning, group updates by risk with a separate Spring Boot group, schedule them with small PR limits, add release-age cooldowns, pin actions by SHA and images by digest, and allow auto-merge only for low-risk patch or minor updates behind required checks, with a test that proves a failing or high-risk update does not merge.",
+      "tools": [
+        "copilot",
+        "claude-code",
+        "codex"
+      ],
+      "tags": [
+        "dependabot",
+        "renovate",
+        "supply-chain",
+        "devsecops",
+        "github-actions",
+        "developer-workflow"
+      ],
+      "formatNotes": "All three. Point the tool at `.github/dependabot.yml` or the Renovate config, every `pom.xml` or `build.gradle(.kts)` and `gradle/libs.versions.toml`, the Dockerfiles, `.github/workflows/`, and CODEOWNERS, and paste the output of `gh api repos/{owner}/{repo}/branches/main/protection` (or the ruleset) so required checks are known. Copilot: dependency-updates path instructions plus those files in agent mode (or save it as `.github/prompts/configure-grouped-dependency-updates.prompt.md`). Claude Code: the dependency-update-automation-guardrails skill plus the files. Codex: AGENTS.md dependency updates section, then the diff.",
+      "body": "Task: Configure grouped, scheduled dependency updates with release-age delays and a narrow, check-gated auto-merge for this repository. Cover Maven or Gradle, GitHub Actions, and Docker. Finish with a minimal diff, a grouping plan, and a test that proves a failing or high-risk update does not merge.\n\nContext placeholders (fill from the repo or ask only if missing):\n- Bot: {{BOT}}  (Dependabot, Renovate, or \"recommend one\"; one bot per ecosystem)\n- Build: {{BUILD}}  (Maven with spring-boot-starter-parent, Maven with the spring-boot-dependencies BOM, or Gradle with version catalog and the Spring Boot plugin)\n- Manifest locations: {{MANIFESTS}}  (e.g. /, /services/*, Dockerfiles in /docker and /services/*/)\n- Other ecosystems: {{OTHER_ECOSYSTEMS}}  (docker-compose, helm, terraform, or none)\n- Schedule and timezone: {{SCHEDULE}}  (e.g. weekly, Monday 09:00, Asia/Kolkata)\n- Release-age delay: {{COOLDOWN}}  (e.g. 5 days patch/minor, 14 days for auto-merged and major)\n- Auto-merge scope: {{AUTOMERGE_SCOPE}}  (e.g. patch and minor of Maven plugins, test libraries, GitHub Actions, image digests; or \"none\")\n- Never auto-merge: {{NEVER_AUTOMERGE}}  (e.g. majors, Spring Boot minors, spring-security, nimbus-jose-jwt, jackson, JDBC drivers)\n- Required checks on main: {{REQUIRED_CHECKS}}  (e.g. build, test, dependency-scan; or \"unknown\")\n- Merge method and queue: {{MERGE_METHOD}}  (merge, squash, or rebase; merge queue yes or no)\n- Private registries: {{REGISTRIES}}  (e.g. Azure Artifacts Maven feed, ACR; or none)\n\nRequirements:\n\n1. Inventory\n   - Table: ecosystem | manifest paths | covered by (Dependabot, Renovate, none) | pinned (actions by SHA, images by digest, yes or no) | open bot PRs today | oldest open bot PR\n   - Flag: ecosystems with no coverage, the same manifest covered by two bots, `@v4`-style or branch refs in `uses:`, `latest` or tag-only base images, managed-version overrides without a reason, literal registry credentials\n\n2. Groups and schedule\n   - Per ecosystem: a tooling and test group (patch and minor), a runtime library group (patch and minor), a Spring Boot group (`org.springframework.boot:*` plus the Boot Gradle plugin; Renovate `group:springBoot`), majors ungrouped\n   - Security updates: own group with `applies-to: security-updates` (Dependabot) or default vulnerability handling (Renovate); never blocked by a version group\n   - Order Dependabot groups from most specific to most general\n   - {{SCHEDULE}} with explicit timezone; `open-pull-requests-limit` (Dependabot) or `prConcurrentLimit` and `prHourlyLimit` (Renovate) between 3 and 5\n   - Use `directories` globs or Renovate defaults for {{MANIFESTS}}; `exclude-paths` for fixtures\n\n3. Release-age delay\n   - Dependabot: `cooldown` with `default-days` and semver-specific days from {{COOLDOWN}}; `exclude` for internal group IDs\n   - Renovate: `minimumReleaseAge` per rule, `internalChecksFilter: \"strict\"`, `waitForAllUpdates: true` on groups\n   - Longer delay for anything inside {{AUTOMERGE_SCOPE}}; state that security updates bypass it\n\n4. Pinning\n   - Separate commit: pin every `uses:` to a full commit SHA with a `# vX.Y.Z` comment; pin base images as `image:tag@sha256:<digest>`\n   - Renovate: extend `config:best-practices` (or add `helpers:pinGitHubActionDigests` and `docker:pinDigests`)\n   - Don't invent SHAs or digests: resolve them with `gh api repos/<owner>/<action>/commits/<tag> --jq .sha` and `docker buildx imagetools inspect <image>:<tag>`, or leave a placeholder and list it\n\n5. Spring Boot\n   - Let Boot and its BOM move managed libraries; list every existing override with its reason; propose removing the ones Boot already covers\n   - Boot patch inside auto-merge only if {{AUTOMERGE_SCOPE}} says so and the test suite covers startup and integration; Boot minor and major never auto-merge\n   - Gradle: keep the Boot plugin and `org.springframework.boot` platform in the same group\n\n6. Auto-merge gate\n   - Confirm {{REQUIRED_CHECKS}} via `gh api repos/{owner}/{repo}/branches/main/protection` or the rulesets API; if none are required, stop and output the ruleset change instead of enabling auto-merge\n   - Confirm repository \"Allow auto-merge\" is on (`gh repo view --json autoMergeAllowed`)\n   - Dependabot: `.github/workflows/dependabot-auto-merge.yml` on `pull_request` only; `if` on `github.event.pull_request.user.login == 'dependabot[bot]'` and the repository name; job-level `contents: write`, `pull-requests: write`; `dependabot/fetch-metadata` pinned by SHA; `gh pr merge --auto --{{MERGE_METHOD}}` only when `update-type` and `dependency-names` fall within {{AUTOMERGE_SCOPE}} and outside {{NEVER_AUTOMERGE}}; no checkout, no scripts, no secrets\n   - Renovate: `packageRules` with `matchUpdateTypes`, `matchPackageNames` or `matchManagers`, `automerge: true`; explicit `automerge: false` rule for {{NEVER_AUTOMERGE}} placed after it\n   - Merge queue: document that `GITHUB_TOKEN` cannot enqueue and that a GitHub App token is needed\n\n7. Registries and secrets\n   - {{REGISTRIES}} as Dependabot `registries` with `${{secrets.NAME}}` or OIDC (`tenant-id`, `client-id`), or Renovate `hostRules` with encrypted values; list the Dependabot secrets to create, without values\n\n8. Ownership and validation\n   - CODEOWNERS for the bot config and the auto-merge workflow\n   - CI step for Renovate: `npx --yes --package renovate -- renovate-config-validator --strict`\n   - Majors ignored only with a comment and a tracking issue\n\n9. Proof\n   - Push a failing test to a patch-group branch: it must not merge\n   - A major and a Spring Boot minor: no auto-merge, reviewers requested\n   - A security update: opens even during cooldown and outside the schedule\n\nConstraints:\n- Minimal diff. Don't change application code, build plugins, or CI jobs beyond pinning and the auto-merge workflow.\n- Never use `pull_request_target`, never check out PR code in the auto-merge job, and never grant workflow-level write permissions.\n- Don't enable auto-merge on a branch without required checks.\n- Don't invent SHAs, digests, group IDs, secret names, or check names; use placeholders and state assumptions.\n- Optimize for GitHub Copilot, Claude Code, and Codex: give concrete diffs and a checklist.\n\nOutput format:\n1. Inventory table with flagged issues\n2. Grouping plan: group | ecosystem | matches | update types | cooldown | auto-merge yes or no | why\n3. Patch: bot config, pinning commit, auto-merge workflow or Renovate rules, CODEOWNERS, validator step\n4. Branch protection or ruleset changes needed (as `gh api` commands to review, not to run)\n5. Proof plan with expected results\n6. Risks and follow-ups (e.g. overrides to remove, majors to plan)\n\nStart with the inventory. Pin before you automate, and gate before you auto-merge.\n"
     }
   ]
 }