Taze Update Action #

Automatically update dependencies using taze and create a pull request with the changes. This assumes that the project is using pnpm.

Features #

• Updates dependencies using taze
• Automatically runs pnpm install after updates
• Creates a pull request with the changes
• Skips PR creation if no updates are available

Usage #

name: Update Dependencies

on:
  schedule:
    - cron: '0 0 * * 0' # Run weekly on Sunday at midnight
  workflow_dispatch: # Allow manual trigger

jobs:
  update-deps:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'pnpm'

      - name: Update dependencies
        uses: YOUR_USERNAME/taze-update-action@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

Inputs #

Examples #

Update dependencies with custom options #

- uses: YOUR_USERNAME/taze-update-action@v1
  with:
    taze-input: '-w --concurrency 2'
    branch-prefix: 'deps/update'
    pr-title: 'Update dependencies'
    pr-labels: 'dependencies,automated'
    github-token: ${{ secrets.GITHUB_TOKEN }}

Update only minor versions #

- uses: YOUR_USERNAME/taze-update-action@v1
  with:
    taze-input: 'minor --concurrency 1'
    github-token: ${{ secrets.GITHUB_TOKEN }}

Update only specific packages #

- uses: YOUR_USERNAME/taze-update-action@v1
  with:
    taze-input: '-w --include react,vue --concurrency 1'
    github-token: ${{ secrets.GITHUB_TOKEN }}

Requirements #

• Your project must use pnpm (I'd consider PRs to extend this somehow)

• A Personal Access Token (PAT) with the following repository permissions:

  • Read access to metadata
  • Read and Write access to code, pull requests, and workflows

  The PAT is required instead of GITHUB_TOKEN to trigger workflow runs on the created PR. Store it as a repository secret and use it in place of secrets.GITHUB_TOKEN.

How it works #

1. Installs taze globally using pnpm
2. Runs taze with the specified arguments to update dependencies
3. Runs pnpm install --no-frozen-lockfile to update the lockfile
4. Creates a new branch with the updates
5. Commits the changes
6. Pushes the branch to the repository
7. Creates a pull request with the specified title and labels

If no dependency updates are available, the action exits gracefully without creating a PR.