Auto-fix Dependencies #1212
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto-fix Dependencies | |
| on: | |
| workflow_run: | |
| workflows: | |
| - "CI Status Check" | |
| types: | |
| - completed | |
| concurrency: | |
| group: auto-fix-${{ github.event.workflow_run.head_sha }} | |
| cancel-in-progress: true | |
| jobs: | |
| auto-fix: | |
| # Only run when CI Status Check fails (PR filtering is done in pr-info step) | |
| if: github.event.workflow_run.conclusion == 'failure' | |
| runs-on: ubuntu-latest | |
| environment: claude-autofix | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| actions: read | |
| steps: | |
| - name: Get PR information | |
| id: pr-info | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |
| with: | |
| script: | | |
| // Get PR from the workflow_run event | |
| const prs = context.payload.workflow_run.pull_requests; | |
| if (!prs || prs.length === 0) { | |
| core.info('No PR associated with this workflow run, skipping'); | |
| core.setOutput('skip', 'true'); | |
| return; | |
| } | |
| const pr = prs[0]; | |
| // Get full PR details | |
| const { data: prData } = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: pr.number | |
| }); | |
| // Check if PR is from a dependency bot | |
| const author = prData.user.login; | |
| const isBot = | |
| author === 'renovate[bot]' || | |
| author === 'dependabot[bot]' || | |
| author === 'app/renovate'; | |
| if (!isBot) { | |
| core.info(`Skipping: PR author is ${author}, not a dependency bot`); | |
| core.setOutput('skip', 'true'); | |
| return; | |
| } | |
| const sameRepo = | |
| prData.head.repo.full_name === `${context.repo.owner}/${context.repo.repo}`; | |
| const isFork = prData.head.repo.fork === true; | |
| if (!sameRepo || isFork) { | |
| core.info( | |
| `Skipping: PR head repo is ${prData.head.repo.full_name} (fork=${isFork})` | |
| ); | |
| core.setOutput('skip', 'true'); | |
| return; | |
| } | |
| core.setOutput('skip', 'false'); | |
| core.setOutput('pr_number', pr.number); | |
| core.setOutput('head_ref', prData.head.ref); | |
| core.setOutput('pr_url', prData.html_url); | |
| core.setOutput('pr_title', prData.title); | |
| core.setOutput('pr_author', author); | |
| - name: Checkout repository | |
| if: steps.pr-info.outputs.skip != 'true' | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ steps.pr-info.outputs.head_ref }} | |
| persist-credentials: false | |
| - name: Auto-fix dependencies | |
| if: steps.pr-info.outputs.skip != 'true' | |
| id: auto-fix | |
| uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c # v1.0.175 | |
| with: | |
| # Requires the CLAUDE_CODE_OAUTH_TOKEN environment secret on claude-autofix. | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| use_bedrock: false | |
| use_vertex: false | |
| allowed_bots: "renovate[bot],dependabot[bot],app/renovate" | |
| prompt: | | |
| **CI Failed - Fix Required** | |
| A dependency update PR from ${{ steps.pr-info.outputs.pr_author }} has failed the status check. | |
| PR: ${{ steps.pr-info.outputs.pr_url }} | |
| Title: ${{ steps.pr-info.outputs.pr_title }} | |
| **Your task:** | |
| 1. Check which CI workflows failed: `gh pr checks ${{ steps.pr-info.outputs.pr_number }}` | |
| 2. Investigate failures using `gh run view` and checking test logs | |
| 3. Fix the issues (e.g., run `bun install` to update lockfile, resolve conflicts, fix breaking changes) | |
| 4. Commit and push the fixes | |
| 5. DO NOT merge - auto-merge will handle it once all CI checks pass | |
| **Important:** | |
| - Focus only on fixing the CI failures | |
| - After pushing fixes, verify all checks pass with `gh pr checks` | |
| - Do not manually merge - this repository uses auto-merge for eligible dependency PRs | |
| - If the issue cannot be fixed automatically, leave a detailed comment explaining the problem | |
| **Tool constraints (MUST follow):** | |
| - Use Read/Glob/Grep tools for file discovery and inspection — never use `ls`, `cat`, `find`, `test` via Bash | |
| - Git commits: use single-line format `git commit -m "type(scope): description"` — NEVER use heredocs, `$(cat <<EOF)`, or multiline -m flags | |
| - Run `git add` and `git commit` as separate Bash calls, not chained with `&&` | |
| - Only use `gh`, `git`, `bun`, `npm` commands via Bash | |
| claude_args: '--allowed-tools "Bash(gh *),Bash(git *),Bash(bun *),Bash(npm *),Read,Write,Edit,Glob,Grep"' |