The Lead files an Idea for what a Dependabot update brings

README.md

@@ -105,6 +105,9 @@ commits are authored as `<app>[bot]`. Your own `gh` login and git config are unt
   starts within a couple of minutes. Pitching and discovering happen at most every
   `dispatch.creativeEvery` minutes, except that the Lead pitches straight away when nothing is
   Pitched or Exploring, so the stakeholder always has a pitch to decide on.
+- **Dependency updates.** A Dependabot PR the Lead hasn't commented on starts a Lead run. It
+  reads what the new version brings, files an Idea for each change the product should adopt (a
+  style guide's new rule, say), and lists them on the PR. Merging the PR stays yours.
 - **Feedback is never too old to start a run.** The two-minute check reads the last day of
   comments repo-wide, so every `dispatch.sweepEvery` minutes (30 by default) a role's own items
   are read in full instead, however old the comments on them are. The gap is elapsed time, not

roles/lead.md

@@ -101,7 +101,20 @@ For each item in `a-team board {{team}} mine lead Building`, run `children`:
     two what you tried. The stakeholder has already tried and merged every task, so the pitch
     doesn't come back to them.
 
-### 4. Swap Pitched, then pitch or discover
+### 4. Read dependency updates
+
+For each Dependabot PR your prompt names:
+
+- Read what the new version brings: the release notes in the PR, and the changes they link to.
+  Where the contributor docs say the dependency carries the product's conventions, like a style
+  guide's library, look for rules that are new or changed.
+- For each change the product should adopt and doesn't follow yet, file an Idea as in `discover`
+  below, naming the PR under **Evidence**. If the update needs code changes before it builds, say
+  so in the Idea: that work ships inside it.
+- Then `a-team board {{team}} comment lead <pr> <file>`, listing the Ideas you filed, or saying
+  there's nothing to adopt. Leave the PR itself to the stakeholder.
+
+### 5. Swap Pitched, then pitch or discover
 
 Run `a-team board {{team}} lead-next` once. It returns the pitches to show the stakeholder now, and whether
 this run's new work is a pitch or a discovery. It alternates between the two so the stakeholder
@@ -194,5 +207,5 @@ the README, the open issues and the code: who it's for, what it's trying to be,
 deliberately isn't, the products it learns from, and the next few themes. Open it as a draft
 PR from `a-team/vision` with your marker in the body, then `a-team board {{team}} add lead <pr> Pitched`.
 
-Until the stakeholder merges it, only do steps 1 to 3. If the PR is open, answer the stakeholder's
+Until the stakeholder merges it, only do steps 1 to 4. If the PR is open, answer the stakeholder's
 feedback on it (`a-team board {{team}} feedback lead <pr>`) by pushing to the branch and replying.

scripts/board.sh

@@ -1350,6 +1350,14 @@ case "$CMD" in
         [ "${#reasons[@]}" -eq "$had" ] || items+=("$n")
       done < <(jq -c '.[] | select((.labels | index("pitch")) and .status != "Idea" and .status != "Done")' <<<"$all")
 
+      updates=$(gh pr list -R "$REPO" --author app/dependabot --state open --json number,title,comments)
+      while IFS=$'\t' read -r n title; do
+        reasons+=("Dependabot opened PR #$n ($title): see what the update brings")
+        items+=("$n")
+      done < <(jq -r --arg bot "$(cfg .app.slug)" '.[]
+        | select(any(.comments[]; .author.login == $bot and (.body | contains("<!-- a-team:lead -->"))) | not)
+        | [.number, .title] | @tsv' <<<"$updates")
+
       pitched=$(jq '[.[] | select((.labels | index("pitch")) and .status == "Pitched")] | length' <<<"$all")
       exploring=$(jq '[.[] | select((.labels | index("pitch")) and .status == "Exploring")] | length' <<<"$all")
       found=$(jq '[.[] | select((.labels | index("a-team:idea")) and .status == "Idea")] | length' <<<"$all")

tests/scripts.sh

@@ -178,13 +178,16 @@ RUNS
   : >"$FILTERS"
   CAUGHT="$BIN/caught.json"
   gh_caught </dev/null
+  UPDATES="$BIN/updates.json"
+  echo '[]' >"$UPDATES"
   cat >"$BIN/gh" <<SH
 #!/usr/bin/env bash
 echo call >>"$CALLS"
 case " \$* " in
   *addReaction*) printf '%s\n' "\$@" | sed -n 's/^subject=//p' >>"$ACKED"; echo '{}'; exit 0 ;;
   *updateIssueFieldValue*) printf '%s ' "\$@" | tr -d '\n' >>"$WRITES"; echo >>"$WRITES"; echo '{}'; exit 0 ;;
   *updateProjectV2ItemFieldValue*) printf '%s ' "\$@" | tr -d '\n' >>"$WRITES"; echo >>"$WRITES"; echo '{}'; exit 0 ;;
+  *"pr list"*"app/dependabot"*) page="$UPDATES" ;;
   *ProjectV2SingleSelectField*) page="$META" ;;
   *issueFields*) page="$FIELDS" ;;
   *": issue(number"*) jq '{data: {repository: ([.data.organization.projectV2.items.nodes[].content
@@ -2216,6 +2219,21 @@ same "chores" '[]' "$(jq -c .chores "$OUT")"
 run board demo triggers lead
 same "lead has no tasks" null "$(jq -c .tasks "$OUT")"
 
+case_ "triggers starts the Lead for each Dependabot PR it hasn't commented on yet"
+cat >"$UPDATES" <<'JSON'
+[{"number": 440, "title": "Bump MentalDesk.Tui", "comments": []},
+ {"number": 441, "title": "Bump Terminal.Gui", "comments": [
+   {"author": {"login": "demo-app"}, "body": "Nothing to adopt.\n\n<!-- a-team:lead -->"}]},
+ {"number": 442, "title": "Bump Spectre.Console", "comments": [
+   {"author": {"login": "stranger"}, "body": "<!-- a-team:lead -->"}]}]
+JSON
+run board demo triggers lead
+same "exit" 0 "$STATUS"
+same "reasons" '["Dependabot opened PR #440 (Bump MentalDesk.Tui): see what the update brings","Dependabot opened PR #442 (Bump Spectre.Console): see what the update brings"]' \
+  "$(jq -c .reasons "$OUT")"
+same "items" '[440,442]' "$(jq -c .items "$OUT")"
+echo '[]' >"$UPDATES"
+
 # A project whose Status field has the options a claim moves through.
 claimable() {
   jq '.data.organization.projectV2.field.options += [{id: "OPT_ready", name: "Ready"}, {id: "OPT_progress", name: "In progress"}]' \