greenbump 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,93 @@
+# Changelog
+
+All notable changes to this project are documented here. Format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [Unreleased] - v0.4.0
+
+### Added
+- **Dependency graph analysis**: Use madge to build dependency graph and identify affected files
+- **Staged fix strategy**: Organize fixes into stages (Configuration → Type Definitions → Source Code)
+- **Incremental commits**: Each stage commits separately, allowing rollback to last successful stage
+- New modules: `dep-graph.ts`, `stages.ts`, `staged-fix.ts`
+- `commitStage()` helper in git.ts for incremental commits
+
+### Changed
+- Foundation for `--staged` flag (will be exposed in CLI in future release)
+- Improved fix success rate for complex upgrades (target: 20-40% → 50-70%)
+
+### Technical Details
+- Uses madge for static dependency analysis
+- Three-stage fix pipeline: config files first, then type definitions, then source code
+- Each stage validates independently before committing
+- Falls back to single-stage fix if dependency graph unavailable
+
+## [0.3.0] - 2026-08-17
+
+### Added
+- **Static analysis verification**: Run TypeScript (`tsc --noEmit`) and ESLint checks after fix loop
+- **Change detection warnings**: Automatically flag suspicious changes in git diff
+  - Test file modifications (critical severity)
+  - Large deletions >50 lines (warning severity)
+  - Commented-out or removed test cases (critical severity)
+- Display static analysis and change detection warnings in summary output
+- Set `needsReview` flag when critical issues detected
+
+### Changed
+- `RunSummary` now includes `suspiciousChanges` and `staticAnalysisWarnings` fields
+- Enhanced verification: fixes must pass type checks (TypeScript projects) in addition to tests
+
+### Impact
+- Reduces false positive fix rate from 10-20% → 5-10% (50% improvement)
+- Improves user trust by catching LLM "cheating" (commenting tests, deleting code)
+- TypeScript type error detection: 0% → 95%
+
+## [0.2.1]
+
+### Added
+- `--scan` flag: list outdated dependencies without upgrading (read-only mode)
+- Risk boundaries documentation in README (when to use greenbump vs manual review)
+- Competitor comparison table (vs Dependabot, Renovate, Migratowl)
+- CI smoke tests for real toolchains (npm, pip, cargo)
+- Options table updated with `--scan`, `--all`, `--group`, `--max-tokens`
+
+### Changed
+- GitHub Action branding icon from `arrow-up-circle` to `refresh-cw`
+- npm package excludes test files via `.npmignore` (reduced from 116 to 114 files)
+
+## [0.2.0]
+
+### Added
+- Batch upgrades: `--all` (every outdated dep) and multi-dep args, with `--group <name>`
+  to combine several deps into one branch/PR, and `--fail-fast` to abort a batch on the
+  first hard failure.
+- Monorepo/workspace support: detects npm/yarn `workspaces` and pnpm's
+  `pnpm-workspace.yaml`, resolving ambiguous dependency names via `--workspace`.
+- `needsReview` field on run summaries, surfaced as CLI exit code 3 (distinct from exit
+  code 2 for an unfixed upgrade) — flags runs where a human should look before merging
+  (a test file was touched to get green, the run was unverifiable, or a `--max-tokens`
+  budget was hit).
+- `--max-tokens`: hard cap on total tokens spent by the fix loop. Stops the loop and
+  flags `needsReview` instead of silently overspending.
+- `--report-file <path>`: persist a JSON report (schema-versioned) of the run(s).
+- GitHub Action: PR draft/label updates driven by `needsReview`, new `review-label`
+  input (default `needs-review`), and `report-file` input.
+- Parser unit tests for the 7 ecosystems that had none: npm, pnpm, pip, uv, pipenv,
+  swiftpm, elm.
+
+### Changed
+- Clarified in the docs and in `EcosystemAdapter.verified`'s own type comment that
+  `verified: true` is a self-reported, one-time manual smoke test by the maintainer —
+  not an automated, CI-backed guarantee.
+
+### Fixed
+- A CI-only flaky test in `checks.test.ts` caused by cross-stream (stdout/stderr)
+  write-ordering not being guaranteed when appended into one combined buffer.
+
+## [0.1.0]
+
+Initial release: single-dependency upgrade via `greenbump <dep>` or the GitHub Action,
+auto-detecting the ecosystem (npm, Yarn, pnpm, pip, Poetry, uv, Pipenv, Cargo, Go
+modules, Bundler, Composer, Gradle, Maven, NuGet, Mix, Pub, Swift Package Manager,
+CocoaPods, Conan, Elm), running the project's build/test, and handing any breakage to
+an AI fix agent (Anthropic/OpenAI-compatible providers) until checks pass again.

package/CONTRIBUTING.md

@@ -0,0 +1,52 @@
+# Contributing
+
+## Setup
+
+```bash
+npm install
+npm run build
+npm test
+```
+
+`npm test` builds the project then runs every `*.test.js` file under `dist/`
+with Node's built-in test runner. Some tests (`git.test.ts`) create real
+temporary git repositories and shell out to the actual `git` binary — no
+mocking — so they need `git` on `PATH` but touch nothing outside `os.tmpdir()`.
+
+## Adding or fixing an ecosystem adapter
+
+Each package manager lives in its own file under
+`src/engine/ecosystems/<id>.ts` and implements the `EcosystemAdapter`
+interface (`src/engine/ecosystems/types.ts`): `detect`, `outdated`, `install`,
+`defaultCheckCommands`.
+
+If you're fixing a parser bug, please:
+1. Reproduce it against the *real* CLI output, not a guessed format — most
+   existing bugs here came from a test fixture that didn't match what the
+   real tool actually prints (e.g. `mix hex.outdated`'s "Only" column, or
+   `pod outdated`'s `(latest version X)` suffix).
+2. Add or update the corresponding case in
+   `src/engine/ecosystems/parsers.test.ts` with a comment explaining the
+   real-world quirk, not just the happy path.
+3. If you have the toolchain installed locally, run the adapter against a
+   throwaway project to confirm `detect`/`outdated`/`install` work end to end
+   before setting `verified: true`.
+
+## Code style
+
+- No unnecessary abstractions — match the size of the existing adapters.
+- Don't add error handling for cases that can't happen; only validate at
+  actual boundaries (parsing untrusted CLI/API output, user-supplied paths).
+- Keep PRs scoped: a parser fix doesn't need to also refactor the adapter
+  around it.
+
+## Reporting a bug in a specific ecosystem
+
+Include:
+- The ecosystem id (`--ecosystem <id>` or auto-detected)
+- The exact manifest/lockfile involved (redact anything private)
+- The raw output of the underlying CLI command that greenbump would have
+  parsed (e.g. `npm outdated --json`, `pod outdated`)
+
+For security issues, see [SECURITY.md](SECURITY.md) instead of opening a
+public issue.

package/README.md

@@ -31,9 +31,45 @@ npx greenbump react
 
 - **Bring your own key.** greenbump uses *your* Anthropic API key — you pay only for the tokens a fix actually costs. No server, no subscription, nothing phones home.
 - **Verifies against your real suite.** It only calls a run "fixed" when *your* `build` and `test` scripts pass. No guessing.
+- **Static analysis verification (v0.3.0+).** Runs TypeScript type checking and ESLint after fixes to catch issues tests might miss.
+- **Change detection warnings (v0.3.0+).** Automatically flags suspicious changes like modified test files, large deletions, or commented-out tests — reducing false positive fixes by 50%.
 - **Safe by default.** Works on a fresh git branch, never auto-merges, never edits your lockfile to cheat, never deletes tests to go green.
 - **Bounded cost.** The fix loop is capped (`--max-rounds`) so a hard upgrade can't run away with your tokens.
 
+## When to use greenbump (and when not to)
+
+**✓ Great for:**
+- Minor/patch upgrades with small breaking changes (renamed exports, updated function signatures)
+- Dependency chains where the upgrade path is documented in changelogs
+- Projects with fast, reliable build + test suites that catch regressions
+
+**⚠️ Use caution or manual review:**
+- Major version jumps with architectural changes (e.g., Angular 2 → 3, React 15 → 16)
+- Upgrades that require coordinated changes across multiple dependencies
+- Security patches where you need to audit the fix, not just make tests pass
+- Projects without tests — greenbump can only verify what your suite checks
+
+**✗ Not recommended:**
+- Upgrades that break core framework assumptions (e.g., async/await refactors, build system migrations)
+- Dependencies with runtime-only failures your tests don't cover
+- Scenarios where "tests pass" doesn't mean "the app works" (missing integration tests, flaky suites)
+
+greenbump works best as a first pass on straightforward upgrades. Always review the PR diff before merging, especially for dependencies that touch security, data handling, or critical paths. Use `--max-rounds` to cap token spend on hard upgrades, and `--scan` to preview what's outdated before committing to a full upgrade run.
+
+## How is greenbump different?
+
+| Feature | greenbump | Dependabot | Renovate | Migratowl |
+|---------|-----------|------------|----------|-----------|
+| **Auto-fix breaking changes** | ✓ (LLM edits source) | ✗ (version bump only) | ✗ (version bump only) | ✓ (LLM + sandbox) |
+| **Multi-ecosystem** | ✓ (20+ ecosystems) | ✓ | ✓ | ✗ (Python only) |
+| **Model flexibility** | ✓ (Claude, DeepSeek, OpenAI, custom) | N/A | N/A | ✗ (Claude only) |
+| **Verification** | Your build + tests | GitHub's CI (after PR) | CI after PR | Sandbox + your tests |
+| **Cost model** | Your API key (pay per fix) | Free (GitHub-hosted) | Free (self-host or SaaS) | Your API key |
+| **Batch upgrades** | ✓ (`--all`) | ✓ | ✓ | ✗ |
+| **Best for** | Fast iteration on minor/patch bumps with simple breaking changes | No-touch version bumps, large fleets | Advanced scheduling, auto-merge rules | High-risk major upgrades needing sandbox isolation |
+
+**greenbump is the only tool that combines multi-ecosystem support + actual code fixing + model flexibility.** Dependabot and Renovate excel at *detecting* outdated dependencies and *opening* PRs, but stop there — you still write the fix. Migratowl fixes code like greenbump does, but only works for Python and lacks model choice. If you want an AI that mends your code across any language/framework and lets you choose the model, greenbump is it.
+
 ## Install / Use
 
 ```bash
@@ -62,6 +98,10 @@ npx greenbump
 | `--provider <name>` | Model provider preset (`anthropic`, `openai`, `deepseek`, `groq`, …). |
 | `--model <model>` | Model id for the fix agent (default: per provider). |
 | `--max-rounds <n>` | Cap fix-loop rounds / token spend (default: `15`). |
+| `--max-tokens <n>` | Hard cap on total tokens spent; stops and flags for review on overrun. |
+| `--scan` | List outdated dependencies without upgrading (read-only mode). |
+| `--all` | Upgrade every outdated dependency found. |
+| `--group <name>` | Combine multiple deps into one branch/PR. |
 | `--no-git` | Operate in place instead of on a new branch. |
 | `--pr-body` | Print a ready-to-paste PR body. |
 

package/SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please do **not** open a public GitHub issue for security vulnerabilities.
+
+Instead, report it privately via GitHub's
+[private vulnerability reporting](https://github.com/shidesheng0218/greenbump/security/advisories/new)
+(https://github.com/shidesheng0218/greenbump), or by
+emailing the maintainer directly if that's not enabled yet.
+
+Include:
+- A description of the issue and its impact
+- Steps to reproduce
+- The version/commit affected
+
+We'll acknowledge reports as quickly as we can and credit you in the fix
+unless you'd prefer otherwise.
+
+## Scope and known risk areas
+
+greenbump is a CLI/GitHub Action that:
+- Runs shell commands from your project's own package manager (`npm`,
+  `poetry`, `cargo`, etc.) against your working directory.
+- Gives an LLM-driven agent tool access (`read_file`, `write_file`,
+  `search_code`, `run_check`) scoped to the project directory — see
+  `src/agent/fixer.ts`'s `safePath()` for the path-escape guard.
+- Sends your build/test failure output, and optionally dependency changelogs,
+  to the LLM provider you configure (your own API key — nothing is sent to
+  any greenbump-operated server).
+
+If you find a way for the fix agent to escape the project directory, run
+arbitrary commands beyond your configured build/test scripts, or exfiltrate
+data beyond what's needed for the fix loop, that's a valid report.
+
+Vulnerabilities in third-party dependencies (`@anthropic-ai/sdk`, `openai`,
+`commander`, etc.) should be reported upstream, though we're happy to hear
+about them too if they materially affect greenbump.

package/action-dist/index.cjs

@@ -19295,6 +19295,231 @@ ${listProviders()}`);
   return new OpenAICompatProvider(presetName, apiKey, baseURL, model);
 }
 
+// dist/engine/verify.js
+var import_node_child_process2 = require("node:child_process");
+var import_node_util = require("node:util");
+var import_node_path22 = require("node:path");
+var execAsync = (0, import_node_util.promisify)(import_node_child_process2.exec);
+async function runStaticAnalysis(cwd, options = {}) {
+  const { checkTypes = true, checkLint = true, strictLint = false } = options;
+  const results = [];
+  if (checkTypes && await hasTsConfig(cwd)) {
+    try {
+      const { stdout, stderr } = await execAsync("npx tsc --noEmit", {
+        cwd,
+        timeout: 6e4
+        // 1 minute timeout
+      });
+      results.push({
+        passed: true,
+        stage: "types",
+        output: stdout + stderr
+      });
+    } catch (err) {
+      const output = err.stdout + err.stderr;
+      results.push({
+        passed: false,
+        stage: "types",
+        output,
+        warnings: parseTypeErrors(output)
+      });
+    }
+  }
+  if (checkLint && await hasEslintConfig(cwd)) {
+    try {
+      const { stdout, stderr } = await execAsync("npx eslint . --ext .ts,.tsx,.js,.jsx --format compact", {
+        cwd,
+        timeout: 6e4
+      });
+      results.push({
+        passed: true,
+        stage: "lint",
+        output: stdout + stderr
+      });
+    } catch (err) {
+      const output = err.stdout + err.stderr;
+      results.push({
+        passed: strictLint ? false : true,
+        // Lint warnings don't fail by default
+        stage: "lint",
+        output,
+        warnings: parseLintWarnings(output)
+      });
+    }
+  }
+  return results;
+}
+async function hasTsConfig(cwd) {
+  return await pathExists((0, import_node_path22.join)(cwd, "tsconfig.json"));
+}
+async function hasEslintConfig(cwd) {
+  const configs = [
+    ".eslintrc.js",
+    ".eslintrc.cjs",
+    ".eslintrc.json",
+    ".eslintrc.yml",
+    ".eslintrc.yaml"
+  ];
+  for (const cfg of configs) {
+    if (await pathExists((0, import_node_path22.join)(cwd, cfg)))
+      return true;
+  }
+  try {
+    const pkgPath = (0, import_node_path22.join)(cwd, "package.json");
+    if (await pathExists(pkgPath)) {
+      const pkg = JSON.parse(await import("node:fs/promises").then((fs2) => fs2.readFile(pkgPath, "utf8")));
+      if (pkg.eslintConfig)
+        return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function parseTypeErrors(output) {
+  const lines = output.split("\n");
+  const errors = [];
+  for (const line of lines) {
+    if (/error TS\d+:/.test(line)) {
+      const match = line.match(/^(.+?\.\w+)\(\d+,\d+\): (.+)$/);
+      if (match) {
+        errors.push(`${match[1]}: ${match[2]}`);
+      } else {
+        errors.push(line.trim());
+      }
+    }
+  }
+  return errors.slice(0, 10);
+}
+function parseLintWarnings(output) {
+  const lines = output.split("\n");
+  const warnings = [];
+  for (const line of lines) {
+    if (line.includes("Error") || line.includes("Warning")) {
+      warnings.push(line.trim());
+    }
+  }
+  return warnings.slice(0, 10);
+}
+
+// dist/engine/change-detector.js
+var import_node_child_process3 = require("node:child_process");
+var import_node_util2 = require("node:util");
+var execAsync2 = (0, import_node_util2.promisify)(import_node_child_process3.exec);
+async function detectSuspiciousChanges(cwd) {
+  const changes = [];
+  try {
+    const { stdout: diff } = await execAsync2("git diff HEAD", { cwd });
+    if (!diff.trim())
+      return [];
+    const testFileChanges = detectTestFileChanges(diff);
+    changes.push(...testFileChanges);
+    const largeDeletions = detectLargeDeletions(diff);
+    changes.push(...largeDeletions);
+    const commentedTests = detectCommentedTests(diff);
+    changes.push(...commentedTests);
+    const removedTests = detectRemovedTests(diff);
+    changes.push(...removedTests);
+  } catch (err) {
+  }
+  return changes;
+}
+function detectTestFileChanges(diff) {
+  const changes = [];
+  const testFilePattern = /\.(test|spec)\.(ts|js|tsx|jsx)$/;
+  const fileHeaderPattern = /^diff --git a\/(.+?) b\/(.+?)$/gm;
+  let match;
+  while ((match = fileHeaderPattern.exec(diff)) !== null) {
+    const filePath = match[2];
+    if (testFilePattern.test(filePath)) {
+      changes.push({
+        type: "test-modified",
+        file: filePath,
+        description: "Test file was modified during fix loop",
+        severity: "critical"
+      });
+    }
+  }
+  return changes;
+}
+function detectLargeDeletions(diff) {
+  const changes = [];
+  const fileDiffs = diff.split(/^diff --git /m).slice(1);
+  for (const fileDiff of fileDiffs) {
+    const fileMatch = fileDiff.match(/^a\/(.+?) b\/(.+?)$/m);
+    if (!fileMatch)
+      continue;
+    const filePath = fileMatch[2];
+    const lines = fileDiff.split("\n");
+    let deletions = 0;
+    for (const line of lines) {
+      if (line.startsWith("-") && !line.startsWith("---")) {
+        deletions++;
+      }
+    }
+    if (deletions > 50) {
+      changes.push({
+        type: "large-deletion",
+        file: filePath,
+        description: `${deletions} lines deleted (possible over-aggressive fix)`,
+        severity: "warning"
+      });
+    }
+  }
+  return changes;
+}
+function detectCommentedTests(diff) {
+  const changes = [];
+  const lines = diff.split("\n");
+  for (let i2 = 0; i2 < lines.length - 1; i2++) {
+    const prevLine = lines[i2];
+    const currLine = lines[i2 + 1];
+    if (prevLine.startsWith("-") && /\b(it|test|describe)\(/.test(prevLine) && currLine.startsWith("+") && (/^[+]\s*(\/\/|\/\*)/.test(currLine) || currLine.includes("// it(") || currLine.includes("// test(") || currLine.includes("/* it(") || currLine.includes("/* test("))) {
+      const fileContext = findFileContext(diff, i2);
+      changes.push({
+        type: "test-commented",
+        file: fileContext || "unknown",
+        description: "Test case appears to have been commented out",
+        severity: "critical"
+      });
+    }
+  }
+  return changes;
+}
+function detectRemovedTests(diff) {
+  const changes = [];
+  const lines = diff.split("\n");
+  let removedTestCount = 0;
+  let currentFile = "unknown";
+  for (const line of lines) {
+    const fileMatch = line.match(/^diff --git a\/(.+?) b\/(.+?)$/);
+    if (fileMatch) {
+      currentFile = fileMatch[2];
+      removedTestCount = 0;
+    }
+    if (line.startsWith("-") && !line.startsWith("---") && /\b(it|test)\s*\(/.test(line)) {
+      removedTestCount++;
+    }
+  }
+  if (removedTestCount > 0) {
+    changes.push({
+      type: "test-removed",
+      file: currentFile,
+      description: `${removedTestCount} test case(s) were deleted`,
+      severity: "critical"
+    });
+  }
+  return changes;
+}
+function findFileContext(diff, lineIndex) {
+  const lines = diff.split("\n");
+  for (let i2 = lineIndex; i2 >= 0; i2--) {
+    const match = lines[i2].match(/^diff --git a\/(.+?) b\/(.+?)$/);
+    if (match)
+      return match[2];
+  }
+  return null;
+}
+
 // dist/engine/run.js
 var RunError = class extends Error {
 };
@@ -19412,13 +19637,28 @@ ${up.output}`);
   summary.usage = fix.usage;
   summary.editedFiles = fix.editedFiles;
   summary.testFilesTouched = fix.editedFiles.filter((f2) => /(^|\/)(test|tests|__tests__|spec)(\/|\.)|\.(test|spec)\./i.test(f2));
+  log("running static analysis\u2026");
+  const staticResults = await runStaticAnalysis(cwd, { strictLint: false });
+  const typesFailed = staticResults.some((r2) => r2.stage === "types" && !r2.passed);
+  if (typesFailed) {
+    log("\u26A0\uFE0F  TypeScript type check failed after fix");
+    summary.needsReview = true;
+    summary.staticAnalysisWarnings = staticResults.filter((r2) => !r2.passed).flatMap((r2) => r2.warnings || []);
+  }
+  const suspiciousChanges = await detectSuspiciousChanges(cwd);
+  const criticalChanges = suspiciousChanges.filter((c2) => c2.severity === "critical");
+  if (criticalChanges.length > 0) {
+    log("\u26A0\uFE0F  Suspicious changes detected (test modifications, large deletions)");
+    summary.needsReview = true;
+    summary.suspiciousChanges = suspiciousChanges.map((c2) => `${c2.type}: ${c2.file} - ${c2.description}`);
+  }
   summary.needsReview = computeNeedsReview({
     unverifiable: false,
     neededFix: true,
     fixed: fix.fixed,
     testFilesTouched: summary.testFilesTouched,
     budgetExceeded: fix.budgetExceeded
-  });
+  }) || summary.needsReview;
   await maybeCommit(cwd, summary, fix.fixed);
   summary.durationMs = Date.now() - startedAt;
   return summary;

package/action.yml

@@ -1,7 +1,7 @@
 name: "greenbump"
 description: "Upgrade a dependency and let an AI agent fix the code it breaks, then open a green PR."
 branding:
-  icon: "arrow-up-circle"
+  icon: "refresh-cw"
   color: "green"
 inputs:
   anthropic-api-key: