The fear of missing out on updates
Do you rely on a test suite that gives you enough confidence to blindly merge pull requests from automatic dependency update bots such as Dependabot or Renovate? If so, you may still be sitting on a backlog of unmerged pull requests because of breaking changes following major updates (and even minor ones…).
Yet, in an age of AI helping attackers exploit vulnerabilities, you’d better have AI help you patch them as soon as possible. Apart from security, it would also be good to solve the breaking-change hassle when upgrading to the next major version of a dependency.
The tedious part
Of course, pulling the faulty branch and asking your local agent to “fix tests following dependency update”, should do the trick. Still, the operation induces friction:
- identify a bot-submitted pull request with failing tests
- pull branch
- prompt agent
- review changes
- push code
- finally, merge pull request
Let’s automate it with GitHub Actions.
The background agent
There is no need to orchestrate our agent manually when it has such clear conditions to start and stop:
- Start: whenever tests fail on a pull request submitted by a dependency-update bot
- Do: based on the failing test log, implement a fix and document it
- Stop with success: if tests pass after fix
- Stop anyway: after time or budget has run out