Dependency release monitor loop skill

Use this pack to install or verify dependency-release-monitor without duplicating the template guide. It reports release evidence and recommendations; it does not merge dependency changes.

Canonical references:

• templates/dependency-release-monitor/loop.yaml — permissions, gates, state paths, verification commands, and backend hints.
• templates/dependency-release-monitor/AGENT-INSTALL.md — complete backend install guide.
• templates/dependency-release-monitor/scripts/dependency_release_monitor.py — checked-in runner used by every backend.
• templates/dependency-release-monitor/examples/dry-run-dependencies.json — local-only dependency config.
• templates/dependency-release-monitor/examples/dependencies.json — editable dependency config for real installs.

If this pack conflicts with templates/dependency-release-monitor/AGENT-INSTALL.md, follow the template guide and fix this pack.

Preflight from repo root

test -f templates/dependency-release-monitor/loop.yaml
test -f templates/dependency-release-monitor/AGENT-INSTALL.md
python3 templates/dependency-release-monitor/scripts/dependency_release_monitor.py --help >/tmp/loopmaster-dependency-release-monitor-help.txt
uv run --with check-jsonschema --with pyyaml check-jsonschema --schemafile spec/loop.schema.json templates/dependency-release-monitor/loop.yaml

Expected result: each command exits 0 and manifest validation prints ok -- validation done.

Pick a backend

• cron: shortest local scheduler path; writes report/state from a persistent env file.
• GitHub Actions: repository scheduler; writes report/state artifacts and opens a PR.
• agent-kanban: recurring agent task; the task runs the helper and creates follow-up cards for high-risk or low-confidence releases.

Use templates/dependency-release-monitor/AGENT-INSTALL.md for exact backend setup.

Fast scratch verification

This is not a live install. It proves release detection and duplicate suppression under /tmp.

rm -rf /tmp/loopmaster-dependency-release-monitor /tmp/loopmaster-dependency-release-monitor-state.json
python3 templates/dependency-release-monitor/scripts/dependency_release_monitor.py \
  --dependencies templates/dependency-release-monitor/examples/dry-run-dependencies.json \
  --state /tmp/loopmaster-dependency-release-monitor-state.json \
  --output-dir /tmp/loopmaster-dependency-release-monitor \
  --max-releases 5
python3 templates/dependency-release-monitor/scripts/dependency_release_monitor.py \
  --dependencies templates/dependency-release-monitor/examples/dry-run-dependencies.json \
  --state /tmp/loopmaster-dependency-release-monitor-state.json \
  --output-dir /tmp/loopmaster-dependency-release-monitor \
  --max-releases 5

Expected stdout shape: first run prints DEPENDENCY_RELEASE_REPORT=..., DEPENDENCIES_CHECKED=2, NEW_RELEASES=2, RECOMMEND_ACT=1, and FETCH_ERRORS=0; second run prints NEW_RELEASES=0, RECOMMEND_ACT=0, and FETCH_ERRORS=0.

Stop or roll back

• cron: remove the crontab line that runs templates/dependency-release-monitor/scripts/dependency_release_monitor.py.
• GitHub Actions: disable or delete the copied workflow in a PR.
• agent-kanban: pause or remove the recurring task.
• Bad report: close/revert the report PR or delete local artifacts after recording the failure.

First-week ownership checklist

• Confirm every recommendation cites release evidence or a fetch error.
• Confirm duplicate suppression works on repeated runs.
• Confirm low-confidence or high-risk recommendations become review tasks.
• Keep major upgrades, dependency merges, credential changes, and public publishing human-gated.