How I built an AI bot that fixes broken npm dependencies (and how it uses GitHub Actions)

说明与用途

AI 机器人自动升级 npm 依赖，修复 ESM 错误，并仅在测试通过时打开 PR。

问题

Dependabot PRs can break builds when a library becomes ESM-only, requiring manual fixes.

结果

The bot updated node-fetch from v2 to v3, detected an ERR_REQUIRE_ESM error, rewrote the import to use .default, and completed the process in 3 minutes, resulting in passing tests and a clean PR.

工作流

• Run tests before upgrade to establish baseline
• Bump the targeted dependency
• If tests fail, send error and source files to an LLM (Groq, Gemini, etc.)
• LLM patches the code
• Repeat the test‑run and patch cycle up to 3 times
• If tests pass, open a PR with the changes
• If tests still fail after 3 attempts, do not open a PR

证据

It runs your tests before the upgrade (baseline check).

来源

If tests fail, it sends the error and source files to an LLM (Groq, Gemini, etc).

来源

The LLM patches the code. The cycle repeats up to 3 times.

来源

It only opens a PR if the tests are green.

来源

I tested it on a repo with node-fetch@2. The bot updated it to v3, saw the ERR_REQUIRE_ESM error, and automatically rewrote the file to use .default import. It took 3 minutes.

来源