---
name: dependency-release-monitor-loop
description: Use when deploying the loopmaster.ai dependency-release-monitor template to watch releases, assess risk, and route high-risk updates for review.
category: loops
requirements:
  - Python 3
  - repository checkout containing templates/dependency-release-monitor
  - uv for manifest validation, or preinstalled pyyaml/jsonschema for tools/validate_manifests.py
  - public release feeds for the default run; backend secret storage for private sources
  - maintainer approval before dependency merges, major upgrades, or credential changes
public: true
deploys-template: dependency-release-monitor
backends:
  - cron
  - github_actions
  - agent_kanban
---

# Dependency release monitor loop skill

Use this pack to install or verify `dependency-release-monitor` without duplicating the template guide. It reports release evidence and recommendations; it does not merge dependency changes.

Canonical references:

- `templates/dependency-release-monitor/loop.yaml` — permissions, gates, state paths, verification commands, and backend hints.
- `templates/dependency-release-monitor/AGENT-INSTALL.md` — complete backend install guide.
- `templates/dependency-release-monitor/scripts/dependency_release_monitor.py` — checked-in runner used by every backend.
- `templates/dependency-release-monitor/examples/dry-run-dependencies.json` — local-only dependency config.
- `templates/dependency-release-monitor/examples/dependencies.json` — editable dependency config for real installs.

If this pack conflicts with `templates/dependency-release-monitor/AGENT-INSTALL.md`, follow the template guide and fix this pack.

## Preflight from repo root

```bash
test -f templates/dependency-release-monitor/loop.yaml
test -f templates/dependency-release-monitor/AGENT-INSTALL.md
python3 templates/dependency-release-monitor/scripts/dependency_release_monitor.py --help >/tmp/loopmaster-dependency-release-monitor-help.txt
uv run --with check-jsonschema --with pyyaml check-jsonschema --schemafile spec/loop.schema.json templates/dependency-release-monitor/loop.yaml
```

Expected result: each command exits 0 and manifest validation prints `ok -- validation done`.

## Pick a backend

- cron: shortest local scheduler path; writes report/state from a persistent env file.
- GitHub Actions: repository scheduler; writes report/state artifacts and opens a PR.
- agent-kanban: recurring agent task; the task runs the helper and creates follow-up cards for high-risk or low-confidence releases.

Use `templates/dependency-release-monitor/AGENT-INSTALL.md` for exact backend setup.

## Fast scratch verification

This is not a live install. It proves release detection and duplicate suppression under `/tmp`.

```bash
rm -rf /tmp/loopmaster-dependency-release-monitor /tmp/loopmaster-dependency-release-monitor-state.json
python3 templates/dependency-release-monitor/scripts/dependency_release_monitor.py \
  --dependencies templates/dependency-release-monitor/examples/dry-run-dependencies.json \
  --state /tmp/loopmaster-dependency-release-monitor-state.json \
  --output-dir /tmp/loopmaster-dependency-release-monitor \
  --max-releases 5
python3 templates/dependency-release-monitor/scripts/dependency_release_monitor.py \
  --dependencies templates/dependency-release-monitor/examples/dry-run-dependencies.json \
  --state /tmp/loopmaster-dependency-release-monitor-state.json \
  --output-dir /tmp/loopmaster-dependency-release-monitor \
  --max-releases 5
```

Expected stdout shape: first run prints `DEPENDENCY_RELEASE_REPORT=...`, `DEPENDENCIES_CHECKED=2`, `NEW_RELEASES=2`, `RECOMMEND_ACT=1`, and `FETCH_ERRORS=0`; second run prints `NEW_RELEASES=0`, `RECOMMEND_ACT=0`, and `FETCH_ERRORS=0`.

## Stop or roll back

- cron: remove the crontab line that runs `templates/dependency-release-monitor/scripts/dependency_release_monitor.py`.
- GitHub Actions: disable or delete the copied workflow in a PR.
- agent-kanban: pause or remove the recurring task.
- Bad report: close/revert the report PR or delete local artifacts after recording the failure.

## First-week ownership checklist

- Confirm every recommendation cites release evidence or a fetch error.
- Confirm duplicate suppression works on repeated runs.
- Confirm low-confidence or high-risk recommendations become review tasks.
- Keep major upgrades, dependency merges, credential changes, and public publishing human-gated.