[PR] docs: add merging-dependabot-prs skill [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart opened a new pull request, #1877:
URL: https://github.com/apache/struts/pull/1877

   Adds a project skill for triaging and landing the Dependabot queue.
   
   ## Why
   
   The rule is not derivable from the repository — the history contradicts itself. `org.htmlunit:htmlunit` 4.21→5.1 (test scope, major) got WW-5634, while `org.webjars:jquery` 3.7.1→4.0.0 (test scope, major) and htmlunit's own 5.1→5.4 minors merged with no ticket. Three agents given the same open queue produced three different ticket verdicts: none, one, and four.
   
   ## What it fixes the rule to
   
   Classification keys off the dependency's **real Maven scope**, not Dependabot's labels — `hibernate-core` and `maven-wrapper` both announce `dependency-type: direct:production` and only one of them ships to users.
   
   A WW ticket is required only for a **compile / runtime / provided** scope dependency at **minor or major**, `<optional>true</optional>` included since it is published in the module's POM. Patch bumps, `<scope>test</scope>` deps, `apps/` showcase deps, GitHub Actions and Maven plugins all merge bare on a green build.
   
   This deliberately supersedes the ticketing of test-scope minors seen in WW-5565/5570, WW-5566/5583 and WW-5596.
   
   ## Two things it pins down
   
   **What "the build passed" means.** `continuous-integration/jenkins/pr-merge` is not a required context in `.asf.yaml` and flakes red ("This commit cannot be built") on otherwise-green PRs — #1867 and #1834 are both in that state right now. The signal is the `Build and Test` matrix; the required contexts are `Build and Test (JDK 17)` on `main` and `Build and Test (8)` on `support/struts-6-x-x`.
   
   **The ticket ID now reaches the commit.** Previously it lived only in the PR title and body: GitHub took the squash subject from Dependabot's commit headline, so `1f1674411` reads `build(deps): bump jackson.version from 2.21.4 to 2.22.0 (#1746)` even though the PR title carried WW-5648. The skill merges with an explicit `--subject`, so `git log --grep WW-` finds dependency bumps.
   
   ## Ticket
   
   None — `.claude/` changes take conventional-commit form per `CLAUDE.md`.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] docs: add merging-dependabot-prs skill [struts]

["lukaszlenart (via GitHub)" <gi...@apache.org>]

lukaszlenart merged PR #1877:
URL: https://github.com/apache/struts/pull/1877


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org