[Patrick Lafrance (patricklafrance)]

Summary

• Removes the audit-monorepo workflow and its prompt (and its row in CONTRIBUTING.md).
• Ports _update-third-parties, _update-dependencies and _update-skills from workleap/wl-app, adapted to this repo:
  • _update-third-parties: one up-front prompt (targets + follow-ups), one subagent per target, deps before skills. No Intent UI target.
  • _update-dependencies: the existing local skill (renamed from update-dependencies) merged with wl-app's opt-in follow-ups (reset + install, validate). The validation, known pins and release-age notes are kept. No model: override.
  • _update-skills: refreshes every skills-lock.json skill, gated on its package being on the latest minor. Uses skills@1.7.4 add … -a codex [claude-code] --copy -y, because skills update refuses this repo's pre-skillPath lock entries and the default install creates absolute-path symlinks.
• Weekly Update dependencies workflow: Step 1 runs the _update-dependencies skill. A new Step 3 runs _update-skills in a subagent after validation. The PR body gains an "Agent skills" section, and a skills-only PR is opened when no npm deps changed. Adds Agent,Task,Skill to --allowedTools.
• Rationale for differences from wl-app: .claude/skills/_update-third-parties/DESIGN.md.

Notes

• The first CI run that pulls a skill will reformat skills-lock.json (2-space indent, adds skillPath). This is expected, and the file is ESLint-ignored.
• packages/honeycomb/src/js/honeycombTypes.ts: comment-only path update, no changeset.

🤖 Generated with Claude Code

[pkg-pr-new]

Open in StackBlitz

@workleap/common-room

pnpm add https://pkg.pr.new/@workleap/common-room@245

@workleap-telemetry/core

pnpm add https://pkg.pr.new/@workleap-telemetry/core@245

@workleap/honeycomb

pnpm add https://pkg.pr.new/@workleap/honeycomb@245

@workleap/logrocket

pnpm add https://pkg.pr.new/@workleap/logrocket@245

@workleap/mixpanel

pnpm add https://pkg.pr.new/@workleap/mixpanel@245

@workleap/telemetry

pnpm add https://pkg.pr.new/@workleap/telemetry@245

commit: e17d219

[Copilot]

🟡 Changes recommended

Installer-change detection can cause CI cleanup to discard validated dependency edits and earlier skill updates.

1 open issue

• Avoid discarding legitimate pre-existing changes after skill pulls · New

What changed in this PR

This PR consolidates dependency and agent-skill updates into local skills and extends the weekly update workflow, while removing the monthly monorepo audit.

Changes:

• Adds third-party update orchestration and package-gated skill refreshes.
• Reuses the dependency-update skill in CI and supports skills-only PRs.
• Removes audit automation and updates related documentation.

File	Description
packages/​honeycomb/​src/​js/​honeycombTypes.ts	Updates a comment-only skill path reference.
CONTRIBUTING.md	Updates the workflow listing.
.github/​workflows/​update-dependencies.yml	Allows skill invocation and subagent tools.
.github/​workflows/​audit-monorepo.yml	Removes the monthly audit workflow.
.github/​prompts/​update-dependencies.md	Adds skill refreshes and skills-only PR handling.
.github/​prompts/​audit-monorepo.md	Removes the audit prompt.
.claude/​skills/​_update-third-parties/​SKILL.md	Coordinates selected updates and follow-ups.
.claude/​skills/​_update-third-parties/​DESIGN.md	Documents repository-specific design decisions.
.claude/​skills/​_update-skills/​SKILL.md	Defines gated skill refreshes and reporting.
.claude/​skills/​_update-dependencies/​SKILL.md	Renames the dependency skill and makes follow-ups opt-in.

_{Review effort: Balanced}