Keeping Node Dependencies Up to Date, Automagically!
Tags: node, actions, yarn, npm
Published: 2019-12-10 18:13:38

---
title: Keeping Node Dependencies Up to Date, Automagically!
published: true
description: Use github actions to automatically create pull requests with package updates.
tags: node, actions, yarn, npm
---

## Obligatory intro paragraph

Maintaining projects is hard. There is a ton to do, and often upgrading dependencies is neglected, or put on the back burner. It's hard to justify spending a few hours upgrading a bunch of libraries that already work. If you have ever had to go back and upgrade a few dozen (hundred??) dependencies that have been neglected for a few year(s), you know how much easier to keep up to date consistently.

A giant dependency upgrade is hard, a sure fire way to ship some bugs, and, in the meantime, you will probably be insecure. [There](https://dependabot.com/blog/why-bother/) [are](https://depfu.com/blog/2016/12/01/why-you-should-keep-your-dependencies-up-to-date) [a](https://nullbeans.com/9-reasons-for-keeping-software-dependencies-up-to-date/) [lot](https://snyk.io/blog/keep-your-dependencies-up-to-date-enable-auto-upgrades-with-snyk/) [of](https://dependabot.com/blog/why-bother/) [reasons](https://hackernoon.com/psa-upgrading-out-of-date-dependencies-is-one-of-the-most-important-things-you-can-do-a9e65e28a786) [to](http://blog.js-republic.com/keep-npm-dependencies-up-to-date/) [upgrade.](https://buttercms.com/blog/strategies-for-keeping-your-packages-and-dependencies-updated)

Forever ago, I discovered greenkeeper.io, which automatically creates pull requests for dependencies which when they get out of date. Unfortunately, it doesn't seem to play nice with Github actions. Maybe it does, IDK, I gave up on it. It occured to me, that this could be a simple github action... Does a premade one already exist? [Yep](https://github.com/taichi/actions-package-update)... BRILLIANT.

Anytime you run this github action, a pull request is made to upgrade dependencies in your package.json files.


## Get to the action!

 *...sorry, sometimes puns __must__ be made* 

Lets install our github action:
  1. Create a [personal access token](https://github.com/settings/tokens), with repository access, and add it to your `secrets` in the settings section of your github repository.
    * *DO NOT LOSE THIS OR LET ANYONE SEE IT*. Your access token is a second github password to your account.
    * [The example recommends naming your secret `GITHUB_TOKEN`](https://github.com/taichi/actions-package-update). I named mine githubAccessToken, since the recommended name does not seem to be valid.
  2. Create a file in your repo, `.github/workflows/update_node_deps.yml`. 

## Configuring your setup.

_I used the yarn version, because I use [yarn workspaces](https://yarnpkg.com/lang/en/docs/workspaces/), and yarn upgrade will update all the packages as well._

```yml
- name: package-update
  uses: taichi/actions-package-update@master
  env:
    AUTHOR_EMAIL: john@example.com
    AUTHOR_NAME: John
    EXECUTE: "true"
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    UPDATE_COMMAND: yarn
  with:
    args: upgrade --latest
```

  _Configuration for [Action Packed React](https://github.com/ericwooley/action-packed-react):_

```yml
on:
  schedule:
  - cron: '0 9 * * *' # https://jasonet.co/posts/scheduled-actions/
name: Update
jobs:
  package-update:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@master
    - name: set remote url
      run: git remote set-url --push origin https://$GITHUB_ACTOR:${{ secrets.githubAccessToken }}@github.com/$GITHUB_REPOSITORY
    - name: package-update
      uses: taichi/actions-package-update@master
      env:
        AUTHOR_EMAIL: ericwooley@gmail.com
        AUTHOR_NAME: Eric Wooley
        EXECUTE: "true"
        GITHUB_TOKEN: ${{ secrets.githubAccessToken }}
        LOG_LEVEL: debug
        UPDATE_COMMAND: yarn
      with:
        args: upgrade --latest --ignore-engines
```

It's mostly stolen from the readme, but it's *__mine__*, and I love it. Here is what I changed and why.

  * Change `secrets.GITHUB_TOKEN` -> `secrets.githubAccessToken`
  * It's set to run on a schedule, of every morning at 9am. See [this guide to cron with github](https://jasonet.co/posts/scheduled-actions/)

```yml
on:
  schedule:
  - cron: '0 9 * * *' # https://jasonet.co/posts/scheduled-actions/
```

  * (optional) Use `yarn upgrade` instead of [ncu](https://www.npmjs.com/package/npm-check-updates), so that workspaces will be updated as well.

```yml
        # ...
        UPDATE_COMMAND: yarn # This says to use yarn as your upgrade tool.
      with:
        args: upgrade --latest --ignore-engines # extra args for yarn
              # --latest means use the latest versions of the pages.
              # ignore engines, means ignore which version of yarn is performing this upgrade.
```

That's it! Every day at 9:00am, you should get a pull request, which updates all your node dependencies. Make sure your running CI!