Meet Buddy

Social Card of this repo

On this page 31

AI code review and dependency updates, in one teammate that runs on your CI with your keys.

Buddy does two jobs that are usually split across two bots and two subscriptions.

It reviews code. Pull requests and your local working tree alike: inline findings anchored to the lines you actually changed, a summary that is worth reading, @buddy commands answered in the thread, merge gates published as real check runs, and CI repair when a failure has an unambiguous fix. Where a hosted reviewer installs an app on your repository and sends your diff to its own infrastructure, Buddy runs as a step in your own workflow against a provider you choose — or against no provider at all, in which case you keep the static analyzers.

It manages dependencies. Scanning, grouping, real changelogs, security advisories from OSV.dev, auto-merge, lock file regeneration and a pinned dashboard issue — across npm, Bun, yarn, pnpm, Composer, Docker, GitHub Actions, pkgx, Launchpad, Go, Rust, Python, Ruby and Zig. It will migrate your existing Renovate or Dependabot configuration for you.

Neither half depends on the other. Run the reviewer alone, run the updater alone, or run both.

Code Review Features

🔍 Inline Findings - Anchored to changed lines, stating the failure rather than a preference
♻️ Incremental - A second push gets new findings, not the ones you already read
💬 Conversational - @buddy review, full-review, summary, resolve, pause, resume, plan, remember, or a plain question
💻 Local Review - buddy review reads the working tree, so problems surface before the PR exists
🦴 No Key Required - --light runs secret scanning, actionlint, shellcheck, hadolint, markdownlint and syntax checks offline
🚦 Merge Gates - Title format, description quality, linked issue and dependency policy, published as a check run
🛠️ CI Repair - buddy fix-ci classifies a failing run and opens the fix when it is clear
🔌 Pipeable - --format json, github annotations, or agent to hand findings to a coding agent
🧠 Your Provider - Anthropic, OpenAI, Google, OpenRouter, or any OpenAI-compatible endpoint

Dependency Features

🔍 Smart Scanning - Lightning-fast dependency detection using Bun, ts-pkgx, and GitHub API
🤖 Automated PRs - Professional pull requests with three separate dependency tables
📁 Multi-Format Support - Handles package.json, pkgx, Launchpad dependency files, and GitHub Actions
🏷️ Dynamic Labeling - Contextual labels based on update type and package ecosystem
👥 Team Integration - Automatic reviewers, assignees, and team notifications
📅 Flexible Scheduling - Cron-based automation with GitHub Actions integration
🔄 Interactive Rebasing - Checkbox-based PR rebasing with conflict detection
📦 Package Grouping - Coordinate related package updates for better change management
🛡️ Security Priority - Prioritizes security updates with configurable strategies
🛠️ Simple Setup Experience - Renovate-like interactive setup with validation and smart recommendations
🔍 Pre-flight Validation - Environment checks, conflict detection, and prerequisite validation
📊 Smart Project Analysis - Automatic project type detection with intelligent recommendations
📈 Progress Tracking - Visual setup progress with step-by-step guidance and recovery capabilities

🚀 Quick Start

# Install buddy
bun add --global @buddysh/buddy

# Interactive setup (recommended)
buddy setup

# Or scan for outdated packages
buddy scan

# Create update pull requests
buddy update

🛠️ Interactive Setup

The fastest way to get started is with the interactive setup command:

buddy setup

This comprehensive setup wizard provides a Renovate-like experience that automatically configures your entire dependency management workflow:

Setup Process

🔍 Step 1: Repository Detection

Automatically detects your GitHub repository from git remote
Validates repository access and configuration

🔑 Step 2: GitHub Token Setup

Guides you through creating a Personal Access Token (PAT)
Explains required scopes (repo, workflow) for full functionality
Helps set up repository secrets for enhanced features

🔧 Step 3: Repository Settings

Walks you through GitHub Actions permissions configuration
Ensures proper workflow permissions for PR creation

⚙️ Step 4: Workflow Configuration Choose from carefully crafted presets:

Standard Setup - Dashboard updates 3x/week, balanced dependency updates
High Frequency - Check for updates multiple times per day
Security Focused - Frequent patch updates with security-first approach
Minimal Updates - Weekly checks, lower frequency
Development/Testing - Manual triggers + frequent checks for testing
Custom Configuration - Create your own schedule

📝 Step 5: Configuration Generation

Creates buddy.config.json with your repository settings
Includes sensible defaults and customization options

🔄 Step 6: Workflow Generation Generates three core GitHub Actions workflows:

buddy-dashboard.yml - Dependency Dashboard Management
buddy-check.yml - Auto-rebase PR checker
buddy-update.yml - Scheduled dependency updates

🎯 Step 7: Final Instructions

Provides clear next steps with git commands
Links to GitHub settings pages for easy configuration
Explains token setup and repository permissions

What You Get

After the enhanced setup completes, you'll have:

✅ Complete automation - Three production-ready workflows with validation
✅ Professional dashboard - Single issue tracking all dependencies
✅ Interactive rebasing - Checkbox-based PR updates with conflict resolution
✅ Smart scheduling - Optimized update frequency based on project analysis
✅ Security focus - Prioritized security updates with best practices validation
✅ Team integration - Proper permissions and settings with health checks
✅ Validated configuration - Pre-tested setup with comprehensive error checking
✅ Project-optimized settings - Configuration tailored to your specific project type
✅ Recovery capabilities - Robust error handling and setup resumption support

📖 Example Pull Request

Buddy creates professional pull requests that include:

Comprehensive update tables with current and target versions
Detailed release notes extracted from changelogs and GitHub releases
Impact analysis showing breaking changes and migration guides
Dynamic labels for package types, update severity, and ecosystems
Automatic reviewers based on package ownership and team configuration
Interactive rebasing with checkbox-based conflict resolution

Screenshot

🔧 Configuration

// buddy.config.ts
import type { BuddyConfig } from '@buddysh/buddy'

export default {
  repository: {
    provider: 'github',
    owner: 'your-org',
    name: 'your-repo',
  },
  packages: {
    strategy: 'patch', // 'major' | 'minor' | 'patch' | 'all'
    ignore: ['@types/node'],
    groups: [
      {
        name: 'React Ecosystem',
        patterns: ['react', 'react-dom', '@types/react'],
        strategy: 'minor',
      },
    ],
  },
  pullRequest: {
    reviewers: ['team-lead'],
    assignees: ['maintainer'],
    labels: ['dependencies', 'automated'],
    autoMerge: {
      enabled: true,
      strategy: 'squash',
      conditions: ['patch-only'],
    },
  },
  schedule: {
    cron: '0 2 * * 1', // Weekly on Monday at 2 AM
  },
} satisfies BuddyConfig

Use Cases

Enterprise Teams

Automated dependency management across multiple repositories
Security-first updates with priority scheduling
Team-based review workflows with automatic assignments
Compliance tracking with detailed update logs

Open Source Projects

Community-friendly PRs with detailed explanations
Contributor onboarding through automated maintenance
Release coordination with grouped package updates
Documentation integration with changelog extraction

CI/CD Pipelines

Scheduled automation with GitHub Actions
Multi-strategy updates (patch, minor, major)
Auto-merge capabilities for trusted updates
Rollback detection with conflict resolution

Workflow Integration

GitHub Actions

name: Dependency Updates
on:
  schedule:

    - cron: '0 2 * * 1' # Weekly

jobs:
  update:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:

      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v1
      - run: bunx @buddysh/buddy update

        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Multiple Strategies

# Daily security patches
buddy update --strategy patch --auto-merge

# Weekly minor updates
buddy update --strategy minor --reviewers team-lead

# Monthly major updates
buddy update --strategy major --assignees senior-dev

🏗️ Architecture

Buddy is built with modern tools and best practices:

⚡ Bun Runtime - Lightning-fast package management and execution
🔍 TypeScript - Full type safety and IDE integration
🧪 Comprehensive Testing - Unit, integration, and E2E test coverage
📦 Modular Design - Extensible plugin architecture
🛡️ Security First - Secure token handling and permission management

Comparison

Feature	Buddy	Dependabot	Renovate
Speed	⚡ Bun-native	🐌 Slower	🐌 Slower
Package Managers	Bun, npm, yarn, pnpm, pkgx, Launchpad	Limited	Limited
Configuration	TypeScript, YAML, JSON/JS, package.json	YAML	JSON/JS
Grouping	✅ Flexible	✅ Basic	✅ Advanced
Zero Config	✅ Yes	✅ Yes	❌ Complex
Self-hosted	✅ Yes	❌ GitHub only	✅ Yes

Contributing

We welcome contributions! Please see our Contributing Guide for details.

Development Setup

# Clone the repository
git clone https://github.com/stacksjs/buddy.git
cd buddy

# Install dependencies
bun install

# Run tests
bun test

# Start development
bun dev

Changelog

Please see our releases page for more information on what has changed recently.

Stargazers

Community

For help, discussion about best practices, or any other conversation that would benefit from being searchable:

Discussions on GitHub

For casual chit-chat with others using this package:

Join the Stacks Discord Server

Postcardware

Two things are true: Buddy will always stay open-source, and we do love to receive postcards from wherever it's used! 🌍 We also publish them on our website.

Our address: Stacks.js, 12665 Village Ln #2306, Playa Vista, CA 90094

Credits

License

The MIT License (MIT). Please see LICENSE for more information.

Made with 💙