bumpwarden

Dependency bumps scored 0 to 100 by a fixed, published rubric, then acted on: safe ones become pull requests, risky ones get held with a migration plan. Nothing merges on its own.

Comment

Inspiration

Dependabot opens seven pull requests and tells you nothing about which of them will break your build. That triage is the real work, and it felt automatable end to end.

What it does

bumpwarden watches the dependencies of a repository and handles the update triage a maintainer normally does by hand. Twice a day, Cloud Scheduler wakes it. It reads the manifest and lockfile from GitHub, resolves candidate versions from the npm registry and deps.dev, and scores every pending bump from 0 to 100 against a fixed, published rubric. Then it acts on its own: a clear bump gets a pull request that edits package.json only, a caution bump gets an issue, a risky one gets a hold issue with a migration plan. Nothing merges, ever. That line is a design decision, not a missing feature: autonomy stops at the merge button.

A second run never spams. Every action carries a hidden bump key, so the next run updates the same issue or pull request in place. Every action is also written to an audit log with the policy rule that fired it and a timestamp. The dashboard, the rubric and the audit log are public pages served by the same Cloud Run service.

Disclosures

I used AI assistance for research, drafting, code navigation, and implementation support. I reviewed the final work myself and take responsibility for the submission.

The product code is new for this hackathon. A few repository tooling scripts are reused from my own project scaffold and appear in my other projects too: a client-bundle secret scanner with its test harness (scripts/check-client-secrets*), the ship-gate runner (verify-ship.mjs), and the lint, duplication and architecture-rule configs. None of it is product code.

Where Gemini fits

The score is arithmetic. The model never moves it. What gemini-3.5-flash does is explain: for each bump it writes a brief covering what changed upstream, what breaks in this specific repository down to file and line, how to migrate, and its confidence. The agent is an ADK LlmAgent with four read-only tools over material the run already fetched. Every claim in a brief is checked against that material. A claim that cannot be traced is dropped rather than shown. Each brief also says in plain words that a model wrote it.

How I built it

Agent Development Kit for TypeScript (@google/adk, LlmAgent) with @google/genai underneath, gemini-3.5-flash through the Gemini API, Cloud Run (europe-west1), Firestore (state, plus run leases through transactions), Cloud Scheduler, Secret Manager. The dashboard is server-rendered TypeScript (Hono), no client framework, with a default-deny content security policy.

Data sources

GitHub REST (manifests, lockfiles, releases, tags, commit compares), the npm registry (version documents, deprecations), deps.dev (publish dates, advisory data from OSV).

Findings and learnings

The free tier shaped the architecture more than any library choice. Five model requests a minute and twenty a day, with a brief costing two, meant briefs are paced against a sliding window, requested two at a time riskiest first, and cached by bump and rubric version. A repeat run costs zero model requests. Separating "arithmetic decides" from "model explains" is also what makes the agent's actions defensible.

Smaller lessons that cost real hours: /healthz never reaches a Cloud Run app, because Google's frontend reserves that path. Reading whole npm packuments is a trap once you meet prisma's 68 MB document, so bumpwarden reads the two small version documents instead, and a full run dropped from 197 MB to 30 MB. And GitHub silently drops labels on issue creation when the token lacks push rights, which taught me that test doubles have to model provider quirks, not just the documented happy path.

Built With

Share this project:

Updates

Submission history