fusion-dependency-review

Review dependency PRs with structured research, existing-PR-discussion capture, multi-lens analysis (security, code quality, impact), and a repeatable verdict template. USE FOR: dependency update PRs, Renovate/Dependabot PRs, library upgrade reviews, "review this dependency PR", "should we merge this update". DO NOT USE FOR: feature PRs, application code reviews, dependency automation/bot configuration, or unattended merge without confirmation.

1starsUpdated 8/13/2026

Security Code Review Git & Version Control #dependency-updates #security #pull-request #github #code-review

Security Assessment

Safe(92/100)

Security Score92/100

About fusion-dependency-review

The fusion-dependency-review skill provides a structured, auditable review workflow for dependency-update pull requests — Renovate/Dependabot bumps, library upgrades, and similar PRs. It solves the problem of inconsistent, ad-hoc dependency reviews by producing repeatable research notes that incorporate existing PR discussion, run a multi-lens analysis, and end in an actionable verdict that requires explicit maintainer confirmation before any merge action. It is an experimental skill (version 0.1.4) owned by @equinor/fusion-core and depends on the GitHub MCP server for PR context.

The workflow is orchestrated through skill-local advisor agents. A target-PR advisor resolves an ambiguous PR first; a research advisor normalizes context (package, version jump, changed files, CI status), fetches existing top-level comments and review threads, and drafts an evidence packet before any scoring. Three lens advisors — security, code quality, and impact — then run in parallel over the same normalized inputs, and the parent skill preserves disagreement between them rather than flattening it. A verdict advisor combines the findings into a recommendation, confidence level, follow-up handoff, and explicit confirmation wording, and a source-control advisor engages only if a next step requires rebase, conflict resolution, or merge-readiness work. Templates for a research packet, verdict, and review tracker keep output consistent, and follow-up issues can hand off to fusion-issue-authoring.

It targets maintainers and reviewers on the Equinor Fusion platform (and other teams wanting a disciplined dependency-review process). The skill is explicitly read-only until a maintainer asks for a mutation step, and it gates every approval, merge, or PR mutation behind explicit user consent — it must not be used for feature PRs, application code review, bot configuration, or unattended merges.

FAQ

What kinds of PRs is this for?

Dependency update PRs — Renovate/Dependabot PRs, library version bumps, and PRs whose titles match patterns like chore(deps): or fix(deps):. It is explicitly not for feature PRs, application code reviews, or dependency bot configuration.

What does it require to run?

The GitHub MCP server, used to fetch PR context including package and version change, changed files, CI status, and existing comments and review threads. It can also hand off follow-up work to the fusion-issue-authoring skill.

Will it merge or approve a PR automatically?

No. The skill is read-only until a maintainer requests a mutation, and it gates every approval, merge, rebase, or push behind an explicit maintainer confirmation prompt. It posts a verdict summary to the PR before any such action.

How is the review structured?

Through advisor agents: resolve the target PR, run a research advisor to build a shared evidence packet, fan out security, code-quality, and impact lens advisors in parallel, then chain into a verdict advisor and, if needed, a source-control advisor. Disagreement between lenses is preserved rather than collapsed early.

What guardrails prevent inaccurate reviews?

Advisors must not fabricate changelog entries or issue reports, must not claim a source was checked if it was not, and must not guess between multiple plausible PRs — they require explicit user selection. No lens scoring happens until PR comments and threads are fetched.