Dependency Dashboard

The dependency dashboard provides a comprehensive overview of your repository's dependencies and open pull requests in a single GitHub issue. Similar to Renovate's dependency dashboard, it offers a centralized view for managing dependency updates.

Features

• Single Source of Truth: View all dependencies and open PRs in one place
• Interactive Controls: Force retry/rebase PRs by checking boxes
• Automatic Updates: Dashboard refreshes automatically when dependencies change
• Categorized Dependencies: Organized by package.json, GitHub Actions, and other dependency files
• Pinnable Issue: Option to pin the dashboard for easy access
• Customizable Content: Configure what sections to display

Quick Start

Basic Usage

Create or update your dependency dashboard:

buddy dashboard

With Options

# Use custom title
buddy dashboard --title "My Project Dependencies"

# Update specific issue
buddy dashboard --issue-number 42

Configuration

Configure the dashboard in your buddy.config.ts:

export default {
  repository: {
    provider: 'github',
    owner: 'your-org',
    name: 'your-repo',
    token: process.env.GITHUB_TOKEN,
  },
  dashboard: {
    enabled: true,
    title: 'Dependency Dashboard',
    pin: true,
    labels: ['dependencies', 'dashboard'],
    assignees: ['team-lead'],
    showOpenPRs: true,
    showDetectedDependencies: true,
    includePackageJson: true,
    includeDependencyFiles: true,
    includeGitHubActions: true,
  },
}

Configuration Options

Dashboard Sections

Open Pull Requests

Lists all open dependency-related pull requests with:

• Interactive checkboxes for force retry/rebase
• Package names being updated
• Direct links to PRs

Example:

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [&nbsp;] <!-- rebase-branch=buddy/update-react-18 -->[chore(deps): update dependency react to v18](../pull/123) (`react`)

Detected Dependencies

Categorized view of all detected dependencies:

npm Dependencies

• Dependencies from package.json files
• Grouped by dependency type (dependencies, devDependencies, etc.)
• Shows current versions

GitHub Actions

• Actions from .github/workflows/ files
• Displays action names and versions
• Organized by workflow file

Dependency Files

• Dependencies from deps.yaml, dependencies.yaml, etc.
• Package manager agnostic dependencies
• Custom dependency file formats

Capped Dependencies

When a package is already at the newest version every declared range allows, updating this repository cannot move it — a dependant declared the ceiling, and it has to be widened where it is declared. These are listed separately rather than offered as updates:

## Capped dependencies

| Package | Installed | Reachable | Latest | Capped by |
|---|---|---|---|---|
| `ts-pantry` | `0.10.56` | `0.10.56` | `0.11.19` | `buddy` (`^0.10.11`) |

Disable with packages.detectResolutionDrift: false. The analysis reads node_modules, so it reports nothing before an install.

Interactive Features

Force Retry/Rebase

Check the box next to any PR to trigger a retry/rebase:

 - [x] <!-- rebase-branch=buddy/update-react-18 -->[chore(deps): update dependency react to v18](../pull/123)

This will:

1. Recreate the PR branch from the base branch with the latest updates
2. Refresh the PR title, body and file changes
3. Untick the box so the request is not replayed

Ticking a box edits the issue, which fires the workflow's issues: [edited] trigger, so the rebase starts within that run rather than waiting for the next scheduled tick. The bot's own untick is ignored by an actor guard, so this cannot loop.

Rebase All

The box below the PR list applies the same rebase to every open Buddy PR at once:

 - [x] <!-- rebase-all-open-prs -->**Click on this checkbox to rebase all open PRs at once**

Manual Trigger

Use the manual trigger at the bottom to force a full repository scan, which creates PRs for anything newly out of date:

- [x] <!-- manual job -->Check this box to trigger a request for Buddy to run again on this repository

All three controls are handled by buddy update-check; run it with --dry-run to see what a tick would do without acting on it.

Automation

Workflow Integration

Add dashboard updates to your workflow:

name: Dependency Dashboard
on:
  schedule:

    - cron: '0 9 _ _ 1,3,5' # Monday, Wednesday, Friday at 9 AM UTC

jobs:
  update-dashboard:
    runs-on: ubuntu-latest
    steps:

      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun install
      - name: Update Dashboard

        run: bunx @buddysh/buddy dashboard
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

💡 Ready-to-use workflow: Buddy includes a pre-built dashboard workflow at .github/workflows/buddy-dashboard.yml that you can use directly. It includes manual triggering, dry-run mode, and customizable options.

Auto-Update

The dashboard automatically updates when:

• New dependency PRs are created
• Existing PRs are merged or closed
• Dependencies are added/removed from files
• Manual trigger is checked

Custom Templates

Create custom dashboard content with templates:

export default {
  dashboard: {
    bodyTemplate: `
# {{repository.owner}}/{{repository.name}} Dependencies

Last updated: {{lastUpdated}}

## Summary

- Open PRs: {{openPRs.count}}
- Package.json files: {{detectedDependencies.packageJson.count}}
- GitHub Actions: {{detectedDependencies.githubActions.count}}

[Custom content here]
    `,
  },
}

Template Variables

Regular Updates

Set up automated dashboard updates in your CI/CD:

# In your GitHub Actions workflow

- run: buddy dashboard

Team Assignment

Assign the dashboard to team members for visibility:

dashboard: {
  assignees: ['team-lead', 'devops-engineer'],
}

Clear Labels

Use descriptive labels for easy filtering:

dashboard: {
  labels: ['dependencies', 'dashboard', 'maintenance'],
}

Troubleshooting

Dashboard Not Creating

Issue: Dashboard command fails with permission errors.

Solution: Ensure GitHub token has required permissions:

• repo scope for private repositories
• public_repo scope for public repositories
• issues:write permission

Dashboard Not Updating

Issue: Dashboard shows outdated information.

Solution:

1. Check if the issue exists and is open
2. Verify repository configuration
3. Run with --verbose for detailed logs

Missing Dependencies

Issue: Some dependencies don't appear in the dashboard.

Solution:

1. Verify file paths are correct
2. Check if files match supported formats
3. Enable verbose logging to see parsing details

Pinning Fails

Issue: Dashboard is created but not pinned.

Solution:

• Set dashboard.pin: true in your config, or run buddy dashboard --pin
• GitHub allows at most three pinned issues per repository — unpin another issue first
• The token needs issues: write
• Pinning is cosmetic: failures are logged and never fail the run

Examples

Basic Dashboard

// buddy.config.ts
export default {
  repository: {
    provider: 'github',
    owner: 'my-org',
    name: 'my-app',
  },
  dashboard: {
    enabled: true,
  },
}

Advanced Configuration

// buddy.config.ts
export default {
  dashboard: {
    enabled: true,
    title: 'My App Dependencies',
    pin: true,
    labels: ['dependencies', 'maintenance', 'automated'],
    assignees: ['tech-lead'],
    showOpenPRs: true,
    showDetectedDependencies: true,
    includePackageJson: true,
    includeDependencyFiles: true,
    includeGitHubActions: true,
  },
}

Minimal Dashboard

// buddy.config.ts
export default {
  dashboard: {
    enabled: true,
    showOpenPRs: true,
    showDetectedDependencies: false,
    title: 'Open Dependency PRs',
  },
}

Related Features

• Pull Requests - Learn about automated PR creation
• GitHub Actions - GitHub Actions dependency management
• Configuration - Complete configuration reference
• CLI Overview - Command-line interface guide