I Built a GitHub Action to Automatically Fix Out-of-Sync Lockfiles and Vulnerabilities

How many times has this happened to you or your team?

1. A developer bumps a package version or merges a quick fix directly in package.json.
2. They forget to run npm install (or pnpm, yarn, bun, deno).
3. The PR is merged, and CI breaks on main because the lockfile is desynchronized. 🤦‍♂️
4. Or worse: merge conflicts in package-lock.json or pnpm-lock.yaml turn into an unnecessary headache.

P.S : This happened for me like I merged all the pull requests from dependabot as a result my workflows all gone BRR Failed :(

To solve this once and for all, I built SyncMyDep — a high-performance GitHub Action that detects manifest and lockfile discrepancies, fixes security vulnerabilities, and automatically commits or opens a PR with the fixes.

---

🌟 What is SyncMyDep?

SyncMyDep is a zero-runtime-overhead GitHub Action written in TypeScript. It automatically keeps your package manifests and lockfiles in sync while fixing security vulnerabilities on autopilot.

✨ Key Features

• 🔍 Lockfile Synchronization: Detects discrepancies across package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock/bun.lockb, and deno.lock.
• 🛡️ Automated Security Audits: Runs native security audit fixes (npm audit fix, pnpm audit --fix, yarn audit, bun pm audit).
• 📦 Supports All Major Package Managers:
  • npm
  • pnpm
  • yarn (v1 Classic & Yarn Berry v2–v4)
  • bun
  • deno
• 🏢 Monorepo Ready: Auto-detects Turborepo, Nx, Lerna, and native workspaces (pnpm, npm, yarn, bun).
• 💬 On-Demand PR Comments: Comment syncdep or /syncdep on any open Pull Request to trigger an instant sync and push directly to that branch!
• 🚦 CI Gating Mode (check-only): Run it as a fast CI linter that fails the build if a lockfile is out of sync.
• 📊 Rich Markdown Diff Reports: Generates clear before-and-after tables in PR descriptions highlighting added (✨), upgraded (🔄), and removed (🗑️) dependencies.

---

⚡ Quick Start: 60-Second Setup

1. Add the Workflow File

Create .github/workflows/syncmydep.yml in your repository:

name: Dependency Sync & Audit

on:
  schedule:
    - cron: "0 8 * * 1" # Runs every Monday at 08:00 UTC
  workflow_dispatch: # Allows manual trigger from GitHub UI
  push:
    paths:
      - "package.json"
      - "pnpm-lock.yaml"
      - "yarn.lock"
      - "bun.lock"
      - "deno.json"
    branches:
      - main

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Run SyncMyDep
        uses: nivinvysakh/syncmydep@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          sync-lockfile: "true"
          fix-audit: "true"

2. Enable GitHub Action Permissions

Make sure your repository allows GitHub Actions to push and create PRs:

1. Go to Settings ➔ Actions ➔ General.
2. Under Workflow permissions, select "Read and write permissions".
3. Check "Allow GitHub Actions to create and approve pull requests".
4. Click Save.

---

💬 The Killer Feature: On-Demand PR Comment (syncdep)

Ever review a PR and notice the author forgot to update their lockfile?

Instead of asking them to pull down the branch, run install, and push again, add .github/workflows/syncmydep-comment.yml:

name: SyncMyDep on PR Comment

on:
  issue_comment:
    types: [created]

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  sync-pr-comment:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - uses: nivinvysakh/syncmydep@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          comment-trigger: "syncdep"
          require-owner: "true" # Restricts command to repo owners/collaborators

Now, just comment syncdep or /syncdep on any PR. SyncMyDep will react with 👀, sync the lockfile, push the update directly to the PR branch, and react with 🚀 when finished!

---

🚦 Strict CI Gating / Check-Only Mode

If you just want to verify that pull requests never introduce broken or out-of-date lockfiles into your main branch:

- uses: nivinvysakh/syncmydep@v1
  with:
    check-only: "true"

If any mismatch or unaddressed vulnerability is found, SyncMyDep emits GitHub step annotations and exits with code 1.

---

⚙️ Custom Configuration (.syncmydep.yml)

You can fine-tune SyncMyDep by adding a .syncmydep.yml file to your project root:

package-manager: "auto"
sync-lockfile: true
fix-audit: true
audit-level: "moderate"
pr-branch: "syncmydep/dependency-fix"
pr-title: "chore(deps): synchronize dependencies"
commit-message: "chore(deps): update lockfile"
pr-labels:
  - "dependencies"
  - "automated-pr"

---

🛠️ Open Source & Feedback

SyncMyDep is 100% open source under the MIT license.

• 📦 GitHub Repository: nivinvysakh/syncmydep
• 🚀 Marketplace Action: https://github.com/marketplace/actions/syncmydep-dependency-sync-pr

If you find it helpful, please consider leaving a ⭐ on GitHub and trying it out in your workflows!