[GioDavid]

Summary

Adds a Claude Code workflow for triaging Dependabot PRs, and tunes dependabot.yml based on the first triage run over the 11 open bumps.

Claude Code triage workflow

• .claude/agents/dependabot-triager.md: a subagent that triages one PR, or a batch of green PRs from the same ecosystem.
  • Reproduces CI in an isolated worktree and classifies each failure as noise, stale base, or a real break.
  • Proposes a minimal fix as a local commit.
  • Never writes to GitHub.
• .claude/skills/dependabot-triage/SKILL.md: adds /dependabot-triage.
  • Lists open Dependabot PRs and runs triager agents on them in parallel.
  • Merges their reports into one risk-ordered table.
  • Any action on GitHub (push, re-run, merge, close) needs explicit approval.

Dependabot config

• Ignore react-native and @react-native/* from 0.87.0. RN 0.87 breaks the whole test suite: react-native-testing-mocks 1.7.0 can't mock native modules before InitializeCore runs. RN also needs native template changes that Dependabot can't make, so upgrade it by hand with upgrade-helper once the mocks support 0.87.
• Ignore gradle-wrapper. The RN template sets the wrapper version (chore(deps): bump gradle-wrapper from 8.14.2 to 9.8.0 in /example/android #286 proposed 9.8.0, newer than any version RN has tested).
• GitHub Actions: updates are now grouped into one PR, with a 30-day cooldown on majors.

Other

• .gitignore: adds .claude/worktrees/, .claude/settings.local.json and audit/.

Follow-ups

• Close chore(deps): bump the react-native group across 1 directory with 9 updates #290 and chore(deps): bump gradle-wrapper from 8.14.2 to 9.8.0 in /example/android #286. These ignore rules don't close PRs that are already open.
• CI runs only compile, lint and test, so green checks on bundler, gradle and github-actions PRs mean they're untested. After merging the Pages action bumps, run pages.yml once by hand.

🤖 Generated with Claude Code