SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Developer builds CLI tool to sort Dependabot PRs, draws firm limits on automation

0
·3 views

A software developer built an open-source CLI tool called dep-triage to automatically categorize open Dependabot pull requests on GitHub into five action buckets — including auto-merge, escalate, close, rebase, and skip — based on a policy file stored in the repository. The tool uses fully deterministic logic with no AI involvement, and dry-run mode is enabled by default to prevent unintended changes. A strict scope check ensures only PRs that exclusively modify dependency manifests or lockfiles are eligible for auto-merge, while any PR touching source code is automatically excluded. To guard against race conditions, the tool re-fetches the latest commit SHA and CI status immediately before applying any merge action, aborting if anything has changed since the initial triage. Testing against a real repository with 11 open PRs revealed edge cases that unit tests missed, including GitHub's combined-status API returning identical responses for both pending CI and absent CI checks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer Builds App to Help People Find Menstrual Products in Public Spaces

A developer created PadForward, a community-powered platform that helps people locate or donate menstrual products at public locations such as train stations, universities, and community centres. The idea came after the developer was caught off guard by an unexpected period while near a train station that offered no access to sanitary products. The app allows users to find nearby pad drop-off points without needing an account or having to ask strangers directly. Donors can also use the platform to identify which locations are most in need of supplies, reducing the guesswork around where to contribute. PadForward was built as a Weekend Challenge submission and is currently available as a live demo on Vercel with its code published on GitHub.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DIY Car Diagnostics With a $18 ESP32 vs. a $180 Dealership Fee

A hobbyist diagnosed an intermittent warning light on their car using an ESP32-C3 microcontroller and a CAN bus transceiver costing under $20 in total, completing the task in eleven seconds. A dealership had quoted $180 simply to plug in a diagnostic tool and schedule the appointment for the following week. Modern vehicles run on a Controller Area Network (CAN bus), a two-wire communication system developed by Bosch in the 1980s, over which dozens of onboard computers continuously broadcast data. While newer vehicles use gateway modules that restrict what third-party tools can read via the OBD-II port, the underlying diagnostic protocols remain accessible to informed users. The author argues that dealership diagnostic pricing reflects control over tooling and software licenses rather than genuine technical complexity.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Node.js Production Security: Key Practices That Stop Real Attacks

A developer with seven years of production experience has published a Node.js security checklist following a costly penetration test that uncovered eleven vulnerabilities in an e-commerce backend. The pentest, conducted on a system handling 40,000 daily requests, revealed issues including an open CORS policy, SQL injection, and session tokens exposed in log files. The checklist prioritizes keeping secrets out of codebases entirely, storing them only in environment variables that are excluded from version control. It also emphasizes regular dependency auditing using npm audit, committing lockfiles, and pinning exact package versions to prevent silent upgrades. Additional recommendations include using the helmet middleware to apply secure HTTP headers with minimal effort.

0 comments Read more at DEV Community