dependabot-bouncer

A command-line tool to manage GitHub dependency updates, supporting both approve and recreate modes for Dependabot initiated pull requests.

Features

• Automatically approve Dependabot pull requests with passing CI
• Interactive mode: review and act on PRs one at a time with approve, skip, recreate, or quit
• Recreate Dependabot pull requests (including those with failing CI)
• Handle merge conflicts and out-of-date branches automatically
• Enable auto-merge with squash strategy on approved PRs
• Flexible deny lists for packages and organizations with wildcard support
• YAML-based configuration file support
• Per-repository configuration overrides
• Command-line flags for one-off operations

Prerequisites

• GitHub CLI (gh) installed and authenticated via gh auth login

Installation

go install github.com/promiseofcake/dependabot-bouncer/cmd/dependabot-bouncer@latest

Usage

The tool uses the GitHub CLI (gh) for all GitHub API operations. Make sure you are authenticated:

gh auth login

Commands

# Approve passing dependency updates
dependabot-bouncer approve owner/repo

# Interactively review PRs one at a time
dependabot-bouncer approve -i owner/repo

# Interactively review PRs for all repositories in config file
dependabot-bouncer approve -i

# Recreate all dependency updates (including failing ones)
dependabot-bouncer recreate owner/repo

# Check for open Dependabot PRs across multiple repositories
dependabot-bouncer check
dependabot-bouncer check owner1/repo1 owner2/repo2

# Show help
dependabot-bouncer --help
dependabot-bouncer approve --help

Approve Flags

• -i, --interactive: Review PRs one at a time, choosing an action for each. When no repositories are given as arguments, uses all repositories from the config file.

Global Flags

• --config: Path to config file (default: ~/.dependabot-bouncer/config.yaml)
• --deny-packages: Additional packages to deny (can be used multiple times)
• --deny-orgs: Additional organizations to deny (can be used multiple times)

Examples

# Approve all passing updates
dependabot-bouncer approve myorg/user-service

# Interactively review PRs — shows CI status, failure details, and a link for each PR
dependabot-bouncer approve -i myorg/user-service
dependabot-bouncer approve -i myorg/user-service myorg/payment-api myorg/gateway-service

# Interactive mode using repositories from config file
dependabot-bouncer approve -i

# Recreate all updates (including failing ones)
dependabot-bouncer recreate myorg/payment-api

# Check multiple repositories for Dependabot PRs
dependabot-bouncer check myorg/user-service myorg/payment-api myorg/gateway-service

# Check repositories from config file
dependabot-bouncer check

# Deny specific packages via command line
dependabot-bouncer approve myorg/user-service \
  --deny-packages github.com/pkg/errors \
  --deny-packages gopkg.in/mgo.v2

# Deny organizations
dependabot-bouncer approve myorg/payment-api \
  --deny-orgs datadog \
  --deny-orgs elastic

# Use custom config file
dependabot-bouncer approve myorg/user-service \
  --config ./my-config.yaml

Configuration

Configuration File

The tool supports a YAML configuration file at ~/.dependabot-bouncer/config.yaml for persistent settings.

Example configuration:

# Global settings apply to all repositories
global:
  denied_packages:
    - github.com/pkg/errors         # Use stdlib errors
    - github.com/dgrijalva/jwt-go   # Unmaintained
    - gopkg.in/mgo.v2               # Old MongoDB driver
    - "*alpha*"                      # No alpha versions
    - "*beta*"                       # No beta versions
    - "*rc*"                         # No release candidates
    - "*/v0"                         # No v0 packages

  denied_orgs:
    - datadog          # Expensive monitoring
    - elastic          # Using OpenSearch

# Repository configurations
# All repos listed here are checked by 'check' command
repositories:
  # Simple tracking (no special config)
  myorg/user-service: {}
  myorg/payment-api: {}

  # Repository with specific overrides
  myorg/legacy-api:
    denied_packages:
      - github.com/gin-gonic/gin@v1   # Need v1.9+
      - github.com/aws/aws-sdk-go     # Use aws-sdk-go-v2
    denied_orgs:
      - hashicorp      # Licensing concerns
    ignored_prs:
      - 123            # Breaking change
      - 456            # Manual review needed

See config.example.yaml for a complete example.

Configuration Priority

Settings are merged in the following order (later overrides earlier):

1. Global config from YAML file
2. Repository-specific config from YAML file
3. Command-line flags

All deny lists are merged (not replaced), so command-line flags add to the configured lists.

Behavior

Command Modes

• approve: Only processes PRs with passing CI checks. For each PR:
  • PRs with merge conflicts (DIRTY) are recreated via @dependabot recreate
  • PRs behind the base branch (BEHIND) are rebased via @dependabot rebase
  • PRs not yet approved are approved
  • Auto-merge is enabled with squash strategy
• approve -i (interactive): Shows all PRs (including failing CI) one at a time with details — URL, CI status, failing check names, merge state, and review status. For each PR you choose an action:
  • Approve — same logic as batch mode (handle conflicts/rebase, approve, auto-merge)
  • Skip — leave the PR as-is
  • Recreate — comment @dependabot recreate
  • Quit — stop reviewing and print a summary of actions taken
• recreate: Processes all PRs regardless of CI status and comments @dependabot recreate on each
• check: Lists open Dependabot PRs with their CI status and merge state across one or more repositories

Package Filtering

Denied packages are matched case-insensitively against the package name extracted from the PR title.

Exact match — an entry without * or @ must match the full package name:

• github.com/pkg/errors matches github.com/pkg/errors but not github.com/pkg/errors/v2

Version-specific denial — an entry containing @ matches as a substring:

• github.com/gin-gonic/gin@v1 matches any package whose name contains that string

Wildcard patterns — entries containing * support leading and/or trailing wildcards:

• *alpha* — contains match (matches any package containing alpha)
• */v0 — suffix match (matches any package ending with /v0)
• github.com/example/* — prefix match (matches any package starting with github.com/example/)

Organization denial — organizations are extracted from package paths and matched exactly (case-insensitive):

• NPM scoped: @datadog/browser-rum → datadog
• GitHub: github.com/datadog/datadog-go → datadog
• gopkg.in: gopkg.in/DataDog/dd-trace-go.v1 → datadog

All denied packages and organizations are skipped with a log message.