SOP(Standard Operating Procedure) for Handling Dependabot PRs

Overview

When developing in a Monorepo environment, you need to manage many dependency libraries. By using GitHub’s Dependabot, you can automatically detect dependency library updates and create PRs.

However, as the number of PRs generated by Dependabot increases, it becomes difficult to determine which PRs should be processed first and which tests should be performed.

In this blog post, we will learn about the Standard Operating Procedure (SOP) for efficiently processing Dependabot-generated PRs.

PR Classification

Basic Classification Criteria

To handle Dependabot PRs, you first need to understand the risk level of each library. You can use the following table to classify the risk level of libraries.

Risk Adjustment by Version

You can adjust the risk based on the library category and the type of version being updated.

Classification Flowchart

Using the basic classification criteria and version-based risk adjustment, you can create the following flowchart. This flowchart makes it easy to classify when adding new libraries or reviewing Dependabot PRs.

Adding a New Library
        │
        ▼
┌───────────────────────────────────┐
│ 1. Used in Production (Runtime)?  │
└───────────────────────────────────┘
        │
    ┌───┴───┐
    │       │
   Yes      No → Low Risk (Dev Tool)
    │
    ▼
┌───────────────────────────────────┐
│ 2. Affects All Apps?              │
└───────────────────────────────────┘
        │
    ┌───┴───┐
    │       │
   Yes      No → Check Scope
    │            │
    │            ▼
    │       Specific App → Medium Risk (Runtime)
    │                      or
    │                      Low Risk (Runtime)
    ▼
┌───────────────────────────────────┐
│ 3. CI Detectable?                 │
└───────────────────────────────────┘
        │
    ┌───┴───┐
    │       │
   Yes      No → High Risk
    │
    ▼
Medium Risk (CI Detectable)

High Risk

High-risk libraries have the following characteristics:

• Direct impact on production (runtime)
• Affects all apps
• Manual testing required

Target Libraries

Handling Method

1. Verify CI passes (run all tests)
2. Check CHANGELOG and Breaking Changes
3. Check migration guide (if applicable)
4. Test all apps and team member review

Medium Risk

Medium-risk libraries have the following characteristics:

• Partial impact on production (runtime)
• Detectable in build (CI)

Target Libraries

Minor, Patch Updates of High-Risk Libraries

Major Updates of CI Detectable (Build/Test/Lint)

Major, Minor Updates with Runtime Impact

Major Updates of Low-Risk Runtime Utilities

Handling Method

1. Verify CI passes (run all tests / specific app tests)
2. Check CHANGELOG
3. Test affected apps and team member review

You can check affected apps with the yarn why <package> command.

Low Risk

Low-risk libraries have the following characteristics:

• Development tools
• Directly detectable in CI
• No impact on users

Target Libraries

Minor, Patch Updates of CI Detectable (Build/Test/Lint)

Patch Updates with Runtime Impact

Pure Development Tools (All Versions)

Minor, Patch Updates of Low-Risk Runtime Utilities

Handling Method

1. Verify CI passes
2. Review by auto-assigned member

Processing Schedule

To efficiently process PRs for the classified library version updates, you can create the following weekly schedule.

This schedule can be adjusted according to your team’s situation.

Priority Guidelines

While it’s ideal to process all PRs quickly, when resources are limited, you need to set priorities. For example, you can use the following guidelines:

• Patch: Process when 5 or more accumulate (handle security vulnerabilities immediately)
• Minor: Process when 2 or more accumulate (handle security vulnerabilities immediately)
• Major: Process after team discussion

Conclusion

This concludes our look at risk classification criteria for efficiently processing Dependabot PRs.

In the next post, we will learn about Dependabot configuration and automation methods using GitHub Actions based on these classification criteria.

• Automation for Handling Dependabot PRs

Github Sponsor Buy me a coffee

Was my blog helpful? Please leave a comment at the bottom. it will be a great help to me!

App promotion

You can use the applications that are created by this blog writer Deku.
Deku created the applications with Flutter.

If you have interested, please try to download them for free.

word learning app for kids

BlaBoo

Korean TOPIK vocabulary app

TOPIK words

Japanese vocabulary app

Japanese words

Chinese HSK vocabulary app

HSK words