trailofbits / trailofbits/claude-code-config
`merge-dependabot` evaluates five PRs in one working tree, then merges on the results
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 2.1k
- Forks
- 161
- Avg merge
- 3d 59m
- Merged PRs (30d)
- 1
Description
commands/merge-dependabot.md:196-197 rules out worktrees:
Do NOT use
wt switch— shallow clones do not support worktrees reliably. Usegit checkoutdirectly when evaluating each PR.
Then :199-206 launches up to five subagents in parallel, all handed the same {repo_path}, each instructed at STEP 1 to run:
cd {repo_path}
git fetch origin pull/{number}/head:pr-{number}
git checkout pr-{number}
Five agents checking out five branches in one working tree clobber each other non-deterministically. Each agent's build and test run evaluates whatever tree the most recent checkout left behind, so the PASS/FAIL verdicts don't reliably correspond to the PRs they're attributed to.
That matters because Phase 4 acts on those verdicts: :494-502 approves and merges. A verdict produced against the wrong tree is worse than no verdict.
This also contradicts the guidance in claude-md-template.md, which notes that subagents inherit the parent's working directory and that parallel agents writing files need real isolation.
The stated premise is also wrong
Shallow clones support git worktree fine. git worktree add works in a --depth clone; the limitation people usually hit is that a branch not present in the shallow history needs fetching first, which this command already does on the line above.
Suggested fix
Any of:
- Give each subagent
isolation: "worktree"(the Agent tool parameter), which handles placement and cleanup - Give each subagent its own clone directory
- Keep the single tree and evaluate sequentially
If a single shared tree is kept for any reason, the parallel launch has to go — the two are mutually exclusive.
Found while reviewing the repo against Anthropic's current docs and the installed CLI (2.1.238). One of five separate findings from the same pass.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read commands/merge-dependabot.md:196-206 and :494-502, then compare its parallel agent launch with the isolation guidance in claude-md-template.md. Reproduce or reason through concurrent checkouts, choose an isolation or sequential-evaluation approach, and verify that each verdict is produced from the corresponding PR before merge decisions are made.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, shell
- Domain
- devops, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100