justinmclean opened a new pull request, #569:
URL: https://github.com/apache/airflow-steward/pull/569
## Summary
Adds dependency-audit, a read-only Triage-mode skill in the repo-health
family. Given a named repo or local checkout, it detects the dependency manager
from the layout (pip / npm / cargo, or trivy for multi-ecosystem), runs the
matching audit tool, and produces a severity-grouped findings report with
proposed upgrades. It never modifies manifests or lock files and never opens
update PRs; surfacing findings for maintainer review is the whole output.
Includes the skill (skills/dependency-audit/SKILL.md), the .agents / .claude
/ .github skill symlinks, the capability:triage row in
docs/labels-and-capabilities.md, and two eval suites under
tools/skill-evals/evals/dependency-audit/ (8 cases): step-scope-selection
covers scope/manager determination, the org-wide and ambiguous paths, and
prompt-injection handling; step-findings-report covers severity ordering,
patchable vs unpatchable grouping, and the no-autopilot-fix discipline.
Notable decisions:
The skill never guesses a manager from the repo name. When a repo is named
but no manager is stated, it proceeds with managers: [] and detects after
cloning, only asking when several ecosystems are genuinely ambiguous.
All eight eval cases grade automatically (the findings-report cases use
findings_present rather than a has_-prefixed key, which would otherwise fall
back to manual review).
## Type of change
<!-- Tick all that apply. -->
- [X] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
- [ ] Tool / bridge contract (`tools/<system>/*.md`)
- [ ] Python package (`tools/*/` with `pyproject.toml`)
- [ ] Groovy reference impl
- [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
- [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
- [ ] Project template (`projects/_template/`)
- [ ] CI / dev loop (`prek`, workflows, validators)
- [X] Other:
## Test plan
- [X] `prek run --all-files` passes
- [ ] For Python packages touched: `uv run pytest` / `ruff check` / `mypy`
passes
- [ ] For Groovy bridges touched: command-line invocation tested end-to-end
- [X] For skill changes: eval suite passes for the affected skill
(`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner
tools/skill-evals/evals/<skill>/`)
- [ ] For skill *behaviour* changes: a new or updated eval fixture is
included in this PR
(a regression test for the bug fixed / the behaviour added — see
CONTRIBUTING.md)
- [X] Other: ran on magpie
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
