dependabot-cron

Dependabot-like Updater Example

This example shows how to build a simple dependency updater using the managers library, running as a scheduled GitHub Action.

How it works

1. Detects which package manager the repository uses (npm, yarn, pnpm, bun, bundler, cargo, go, uv, poetry, composer, mix, pub, cocoapods)
2. Runs the outdated command to find dependencies with available updates
3. For each outdated dependency, creates a branch, updates it, and opens a PR

Files

• main.go - The updater program
• .github/workflows/deps-update.yml - GitHub Action workflow (copy to your repo)

Usage

As a GitHub Action

Copy the workflow file to your repository:

mkdir -p .github/workflows
cp .github/workflows/deps-update.yml your-repo/.github/workflows/

The action runs weekly by default. Edit the cron schedule to change frequency:

schedule:
  - cron: '0 9 * * 1'  # Every Monday at 9am UTC

Running locally

cd docs/examples/dependabot-cron
go build -o deps-update .
./deps-update /path/to/your/repo

Comparison with Dependabot

This is a starting point. For production use, you'd want to add:

• Version constraints (don't update major versions automatically)
• Grouping related updates into single PRs
• Rate limiting to avoid too many PRs
• Better error handling and logging
• Integration with your CI to verify updates don't break things