DEV Community: Eclipse 🍃

I Built a GitHub Action to Automatically Fix Out-of-Sync Lockfiles and Vulnerabilities

Eclipse 🍃 — Sun, 23 Aug 2026 18:05:38 +0000

How many times has this happened to you or your team?

A developer bumps a package version or merges a quick fix directly in package.json.
They forget to run npm install (or pnpm, yarn, bun, deno).
The PR is merged, and CI breaks on main because the lockfile is desynchronized. 🤦‍♂️
Or worse: merge conflicts in package-lock.json or pnpm-lock.yaml turn into an unnecessary headache.

P.S : This happened for me like I merged all the pull requests from dependabot as a result my workflows all gone BRR Failed :(

To solve this once and for all, I built SyncMyDep — a high-performance GitHub Action that detects manifest and lockfile discrepancies, fixes security vulnerabilities, and automatically commits or opens a PR with the fixes.

🌟 What is SyncMyDep?

SyncMyDep is a zero-runtime-overhead GitHub Action written in TypeScript. It automatically keeps your package manifests and lockfiles in sync while fixing security vulnerabilities on autopilot.

✨ Key Features

🔍 Lockfile Synchronization: Detects discrepancies across package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock/bun.lockb, and deno.lock.
🛡️ Automated Security Audits: Runs native security audit fixes (npm audit fix, pnpm audit --fix, yarn audit, bun pm audit).
📦 Supports All Major Package Managers:
- npm
- pnpm
- yarn (v1 Classic & Yarn Berry v2–v4)
- bun
- deno
🏢 Monorepo Ready: Auto-detects Turborepo, Nx, Lerna, and native workspaces (pnpm, npm, yarn, bun).
💬 On-Demand PR Comments: Comment syncdep or /syncdep on any open Pull Request to trigger an instant sync and push directly to that branch!
🚦 CI Gating Mode (check-only): Run it as a fast CI linter that fails the build if a lockfile is out of sync.
📊 Rich Markdown Diff Reports: Generates clear before-and-after tables in PR descriptions highlighting added (✨), upgraded (🔄), and removed (🗑️) dependencies.

⚡ Quick Start: 60-Second Setup

1. Add the Workflow File

Create .github/workflows/syncmydep.yml in your repository:

name: Dependency Sync & Audit

on:
  schedule:
    - cron: "0 8 * * 1" # Runs every Monday at 08:00 UTC
  workflow_dispatch: # Allows manual trigger from GitHub UI
  push:
    paths:
      - "package.json"
      - "pnpm-lock.yaml"
      - "yarn.lock"
      - "bun.lock"
      - "deno.json"
    branches:
      - main

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Run SyncMyDep
        uses: nivinvysakh/syncmydep@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          sync-lockfile: "true"
          fix-audit: "true"

2. Enable GitHub Action Permissions

Make sure your repository allows GitHub Actions to push and create PRs:

Go to Settings ➔ Actions ➔ General.
Under Workflow permissions, select "Read and write permissions".
Check "Allow GitHub Actions to create and approve pull requests".
Click Save.

💬 The Killer Feature: On-Demand PR Comment (`syncdep`)

Ever review a PR and notice the author forgot to update their lockfile?

Instead of asking them to pull down the branch, run install, and push again, add .github/workflows/syncmydep-comment.yml:

name: SyncMyDep on PR Comment

on:
  issue_comment:
    types: [created]

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  sync-pr-comment:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - uses: nivinvysakh/syncmydep@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          comment-trigger: "syncdep"
          require-owner: "true" # Restricts command to repo owners/collaborators

Now, just comment syncdep or /syncdep on any PR. SyncMyDep will react with 👀, sync the lockfile, push the update directly to the PR branch, and react with 🚀 when finished!

🚦 Strict CI Gating / Check-Only Mode

If you just want to verify that pull requests never introduce broken or out-of-date lockfiles into your main branch:

- uses: nivinvysakh/syncmydep@v1
  with:
    check-only: "true"

If any mismatch or unaddressed vulnerability is found, SyncMyDep emits GitHub step annotations and exits with code 1.

⚙️ Custom Configuration (`.syncmydep.yml`)

You can fine-tune SyncMyDep by adding a .syncmydep.yml file to your project root:

package-manager: "auto"
sync-lockfile: true
fix-audit: true
audit-level: "moderate"
pr-branch: "syncmydep/dependency-fix"
pr-title: "chore(deps): synchronize dependencies"
commit-message: "chore(deps): update lockfile"
pr-labels:
  - "dependencies"
  - "automated-pr"

🛠️ Open Source & Feedback

SyncMyDep is 100% open source under the MIT license.

📦 GitHub Repository: nivinvysakh/syncmydep
🚀 Marketplace Action: https://github.com/marketplace/actions/syncmydep-dependency-sync-pr

If you find it helpful, please consider leaving a ⭐ on GitHub and trying it out in your workflows!

Meet OrbitCI: The Autonomous AI PR Assistant Powered by Google Gemini 🤖✨

Eclipse 🍃 — Thu, 20 Aug 2026 14:34:07 +0000

Hey everyone! 👋

I built OrbitCI, an open-source workflow that brings Google Gemini directly into your GitHub Pull Request comments.

Why OrbitCI?

Stop switching tabs to paste code into AI chats. OrbitCI lets you interact with Gemini natively inside PR threads:

Interactive: Tag @OrbitCI in PR comments to review code, spot bugs, or request refactors.
Context-Aware: Analyzes full PR diffs with Google Gemini.
Containerized: Plugs straight into your existing GitHub CI workflow.

Get Started

Check out the code, star the repo, or contribute here:

👉 GitHub: OrbitCi

Disclaimer: Independent open-source project, not affiliated with Google LLC.

I Built a Retro CRT Terminal Portfolio (TUI) with Astro.js v5 & Tailwind CSS

Eclipse 🍃 — Wed, 05 Aug 2026 07:15:35 +0000

Hey everyone! I just open-sourced astro-tui-portfolio, a retro terminal-inspired portfolio template built with Astro.js v5 & Tailwind CSS v4.

Features:

Interactive bash-like CLI + Visual GUI Dashboard
5 CRT Phosphor color themes (Green, Amber, Cyan, Dracula, Mono)
Web Audio API sound synthesizer
HTML5 Canvas Matrix Rain overlay

Feel free to check out the repo and use it for your own portfolio:

👉 GitHub: https://github.com/nivinvysakh/astro-tui-portfolio

Let me know your thoughts or feedback! ⭐

Build your own Discord Chat GPT Bot.

Eclipse 🍃 — Sat, 10 Jun 2023 16:08:24 +0000

Are you looking to create a Discord bot that can interact with users using natural language processing? Then, you're in luck! In this tutorial, we'll walk you through the steps to create a Discord bot and integrate it with OpenAI.

Step 1: Create a Discord Bot
The first step is to create a Discord bot. You can create a bot by following the official Discord Developer Portal documentation. Once you have created a bot, you will receive a token that you will need to use in your code.

Step 2: Install Dependencies
To use OpenAI in your bot, you will need to install the openai Python package. You can install it using pip:

pip install openai

You will also need to install the discord.py package to interact with the Discord API:

pip install discord.py

Step 3: Create a Python Script
Next, create a Python script that will handle the bot's logic. Here's a sample script that responds to user messages using OpenAI:

import discord
import openai
from discord.ext import commands

openai.api_key = "YOUR_API_KEY"

bot = commands.Bot(command_prefix='!')

@bot.event
async def on_ready():
    print(f'{bot.user.name} has connected to Discord!')

@bot.event
async def on_message(message):
    if message.author == bot.user:
        return

    response = openai.Completion.create(
        engine="davinci",
        prompt=message.content,
        max_tokens=60
    )

    await message.channel.send(response.choices[0].text)

bot.run("YOUR_DISCORD_BOT_TOKEN")

Replace YOUR_API_KEY with your OpenAI API key and YOUR_DISCORD_BOT_TOKEN with your Discord bot token.

Step 4: Run the Bot
To run the bot, save the Python script as bot.py and run the following command in your terminal:

python bot.py

This will start the bot and connect it to your Discord server.

Step 5: Test the Bot
Finally, test the bot by sending a message on your Discord server. The bot should respond with a message generated by OpenAI.

That's it! You have successfully created a Discord bot that can interact with users using OpenAI. With this powerful combination, you can create a bot that can answer questions, provide recommendations, and much more.