Automatically Creating GitHub Pull Requests

We recently shipped an RWX package to create GitHub pull requests. It's the fastest and easiest way to automate opening PRs.

Speed of Implementation

I built an example for this blog post showing how to automate an npm update – more information below on why we often prefer this over using tools like dependabot.

It only took a few minutes to build this workflow.

In the demo video I made a mistake in the first implementation and inadvertently showcased one of the biggest benefits of RWX's caching.

Running npm update takes a little bit over 2 minutes. I initially had a typo in my command to open the pull request.

Normally, this means I would have to wait a full 2 minutes again to check the fix. However, since RWX had just run npm update, the update execution was fully cached. This meant that when I re-ran the workflow with the typo fixed, the run immediately skipped to creating the pull request, producing a cache hit on the npm update.

Between the local CLI and caching mechanics, implementing workflows on RWX can be an order of magnitude faster than on CI/CD platforms without automatic caching.

Using the Create Pull Request Package

Because the default RWX GitHub App does not have permissions to create pull requests, you'll need to create a private GitHub App for your bot.

After that, automating pull requests is easy.

• Clone a git repository using the git/clone package. Remember to pass preserve-git-dir: true
• Define a task to make the desired changes
• Call the github/create-pull-request package

Use Cases

You can use this package to automatically open PRs for anything that you want.

Running package manager updates is a fairly good use case. Although tools like dependabot and Mend Renovate can handle updates, they often work less well than the native package manager CLIs for a couple of reasons:

• The third-party tools don't always update transitive dependencies, which are relevant for security and bug fixes
• Third-party tools start blurring the lines of where configuration happens, sometimes pinning versions in the native package specification, and sometimes pinning in the third-party tool configuration

Code

1
on:
2
  cron:
3
    - key: npm-update
4
      schedule: '0 7 * * 1 America/New_York' # At 7am ET on Monday
5

6
base:
7
  os: ubuntu 24.04
8
  tag: 1.1
9

10
tasks:
11
  - key: code
12
    call: git/clone 2.0.0
13
    with:
14
      repository: https://github.com/rwx-cloud/rwx.com.git
15
      ref: main
16
      github-token: ${{ github-apps.rwx-cloud-bot.token }}
17
      preserve-git-dir: true
18

19
  - key: tool-versions
20
    use: code
21
    call: rwx/tool-versions 1.0.4
22
    filter: [.tool-versions]
23

24
  - key: nodejs
25
    call: nodejs/install 1.1.7
26
    with:
27
      node-version: ${{ tasks.tool-versions.values.nodejs }}
28

29
  - key: npm-install
30
    use: [nodejs, code]
31
    run: npm install
32
    filter: [package.json, package-lock.json]
33

34
  - key: npm-update
35
    use: npm-install
36
    run: |
37
      npm update | tee $RWX_VALUES/update-output
38
      (npm outdated || true) | tee $RWX_VALUES/outdated-output
39

40
  - key: create-pull-request
41
    call: github/create-pull-request 1.0.1
42
    use: npm-update
43
    with:
44
      github-token: ${{ github-apps.rwx-cloud-bot.token }}
45
      branch-prefix: npm-update
46
      pull-request-title: npm update
47
      pull-request-body: |
48
        ## Updated Packages
49

50
        ```
51
        ${{ tasks.npm-update.values.update-output }}
52
        ```
53

54
        ## Outdated Packages
55

56
        ```
57
        ${{ tasks.npm-update.values.outdated-output }}
58
        ```

Demo