feat: add Dependabot consolidation skill

[Victor Vazquez (vhvb1989)]

Summary

• add a reusable workflow skill for consolidating repository Dependabot PRs and security alerts
• reuse an existing marked consolidation PR when available
• validate grouped updates and close only source PRs proven incorporated
• document authenticated registry and blocked-update handling

Validation

• git diff --cached --check

No evaluation files are included in this change.

[azure-pipelines]

Azure Pipelines:
22 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

🔗 Linked Issue Required

Thanks for the contribution! Please link a GitHub issue to this PR by adding Fixes #123 to the description or using the sidebar.
No issue yet? Feel free to create one!

[Copilot]

Pull request overview

Adds a workflow skill to consolidate Dependabot updates and security alerts into one maintained PR.

Changes:

• Defines skill triggers, safeguards, and exit criteria.
• Documents inventory, validation, PR reuse, and source-PR closure workflows.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/skills/dependabot-consolidation/SKILL.md	Defines the skill and safety rules.
.github/skills/dependabot-consolidation/references/workflow.md	Provides the detailed consolidation procedure.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

.github/skills/dependabot-consolidation/references/workflow.md:188

• These markdown tables have an extra leading | on each row (|| ...), which renders as an unintended empty first column. Update the rows to use a single leading pipe (| ...) for a standard 2-column table.

| Ecosystem | Preferred approach |
|---|---|
| Go modules | Run `go get <module>@<version>` and `go mod tidy` in the affected module only |
| npm | Use the package manager and lockfile already present; update only the affected package |
| GitHub Actions | Preserve SHA pinning when present and update the paired version comment |
| NuGet | Use the existing project or central package-management mechanism |
| Maven | Update the owning `pom.xml` property/dependency and regenerate existing lock data |
| pip | Update the declared constraint and regenerate the existing lock/requirements output |

.github/skills/dependabot-consolidation/references/workflow.md:244

• The PR body template tables also use || at the start of each row, which will render with an empty first column. Use a single leading | per row so the tables render correctly when copied into a PR description.

| PR | Update | Status |
|---|---|---|
| #123 | package update | Included |

.github/skills/dependabot-consolidation/references/workflow.md:250

• The PR body template tables also use || at the start of each row, which will render with an empty first column. Use a single leading | per row so the tables render correctly when copied into a PR description.

| Alerts | Manifest | Package | Patched version | Severity | Status |
|---|---|---|---|---|---|
| #456, #457 | path/to/lockfile | package | 1.2.3 | high | Covered |

.github/skills/dependabot-consolidation/SKILL.md:17

• The comma before or makes this list grammatically inconsistent. Consider removing the comma so the final item reads cleanly as 'Renovate PRs or work outside Azure/azure-dev.'

  DO NOT USE FOR: one named dependency, reviewing or merging PRs, dismissing alerts,
  Renovate PRs, or work outside Azure/azure-dev.