Use depfu and Mergify to automatically merge dependency updates
Tags: github, cicd, devops
Published: 2021-05-03 09:08:56

---
title: Use depfu and Mergify to automatically merge dependency updates
published: true
description: The repetitive task of updating project dependencies should be a robot's job. Let's teach the robots how!
tags:
 - GitHub
 - CICD
 - DevOps
cover_image: https://images.unsplash.com/photo-1508175800969-525c72a047dd?ixid=MnwxMjA3fDB8MHxwaG90by1wYWdlfHx8fGVufDB8fHx8&ixlib=rb-1.2.1&auto=format&fit=crop&w=3267&q=80
---
Over the years, I have accumulated quite a few free time projects that one after another become stale. Security alerts keep rolling in and getting all projects up-to-date is exhausting and might feel overwhelming. Let's automate this task!

## depfu

For some time, I have updated the projects manually, however this became way too time consuming. Enter [depfu](https://depfu.com/), a free (for open source projects) service that keeps your project's dependencies up-to-date by proposing pull requests (PRs) whenever there's a new dependency version. [Renovate](https://renovatebot.com/) is a similar service, and would work the same for the purpose of this tutorial. Depfu has made my life much easier – it automatically creates PRs and the only job left for me is to approve and merge the PR. This is all well and good, however with many projects, even this process becomes tedious. Let's try to automate this task even further!


## Mergify

[Mergify](https://mergify.io/) can merge PRs automatically and lets us define rules for when that should happen. Together, depfu and Mergify can automatically keep our dependencies updated.

## Actual tutorial

### Step 1: Create depfu and Mergify accounts

Before we can start configuring these tools, we'll need to create one account in each service, and give the services the required permissions. Once this is done, depfu will start creating dependency update PRs in the projects that were added in the depfu GUI.

### Step 2: Configure Mergify

We can configure Mergify in a `.mergify.yml` file placed in the root of our project. Mergify has a [great deal of example configurations](https://docs.mergify.io/examples/) which is very helpful when new to the tool. This configuration is very powerful, however our task is quite simple and doesn't need much writing:

```yaml
pull_request_rules:
  - name: Automatic merge for depfu pull requests
    conditions:
      - author=depfu[bot]
      - base=main # or master
    actions:
      merge:
        method: merge
```

That's actually all that we need! We ensure that it was actually depfu that created the PR, then check that the PR will be merged to the main branch. Now, every pull request created by depfu will be merged automatically.

## Is automating this a good idea?
We should ask ourselves if we actually want dependency updates to be merged automatically. They should be subject to review and should perhaps not be merged into the codebase uncritically. This can be mitigated by adding automated tests and to run build scripts on every commit. If required checks fail, Mergify won't merge the PR. Also, Mergify has another trick up it's sleeve: We can do a RegEx search on the PR's title. This combines neatly with the fact that depfu adds a `(major)`, `(minor)` or `(patch)` label to the end of the PR title. We can filter out major and minor updates, and our final Mergify config now looks like this:

```yaml
pull_request_rules:
  - name: Automatic merge for depfu pull requests
    conditions:
      - author=depfu[bot]
      - base=main # or master
      - title~=\(patch\)$
    actions:
      merge:
        method: merge
```

## PRs in my repository must be reviewed before merge

Oh, do they now? As said before, Mergify will wait until no required checks fail, and that includes required reviews. No problem (*thanks, Julien Danjou*)! We can automate PR reviewal as well! Let's add to `.mergify.yml`:

```yaml
pull_request_rules:
  - name: Automatic approval for depfu pull requests
    conditions:
      - author=depfu[bot]
    actions:
      review:
        type: APPROVE

  - name: Automatic merge for depfu pull requests
    conditions:
      - author=depfu[bot]
      - base=main # or master
      - title~=\(patch\)$
    actions:
      merge:
        method: merge
```

## Done!

Now, with these new apps and actions, dependency update pull requests will be created, reviewed and merged 🌼automatically🌼! The [GitHub Marketplace](https://github.com/marketplace) is filled with gems like these and I encourage you all to explore the list to make life easier and more automated!