Give Every Dependabot PR a Risk Label Before You Click Review

Description and use

An automated script uses an LLM to assess Dependabot PR risk and posts a label, speeding up reviews.

Problem

Dependabot PRs lack context on whether changes matter, leading to tedious manual triage and potential bugs.

Outcome

Automated risk labeling reduces manual effort, speeds up PR reviews, and lowers the chance of overlooking breaking changes.

Workflow

• 1. Configure GitHub token and LLM API credentials. 2. Run the Python script (dependabot_triage.py) on a schedule or as a GitHub Action. 3. Script fetches PR metadata and diff stats via GitHub API. 4. Extracts changelog from PR body or linked release page. 5. Sends prompt to LLM and parses JSON risk output. 6. Writes a GitHub check or PR comment with risk label and one‑sentence reason. 7. Reviewers see the label and decide to merge or request changes.

Evidence

A small LLM can do that triage for you: read the changelog, inspect the diff stats, and output a risk label plus a one-sentence reason.

Source

The script is designed to run anywhere — a GitHub Action, a cron job, or a free server slot.

Source