Bump dependencies in OpenShift projects with automated analysis and PR creation
Automates dependency updates in OpenShift projects with analysis, testing, Jira tickets, and PR creation.
/plugin marketplace add openshift-eng/ai-helpers/plugin install openshift@ai-helpers<dependency> [version] [--create-jira] [--create-pr]openshift:bump-deps
/openshift:bump-deps <dependency> [version] [--create-jira] [--create-pr]
The openshift:bump-deps command automates the process of bumping dependencies in OpenShift organization projects. It analyzes the dependency, determines the appropriate version to bump to, updates the necessary files (go.mod, go.sum, package.json, etc.), runs tests, and optionally creates Jira tickets and pull requests.
This command significantly reduces the manual effort required for dependency updates by automating:
The command intelligently handles different dependency types (Go modules, npm packages, container images, etc.) and can process single or multiple dependencies at once.
The command executes the following workflow:
For Go Projects:
go list -m -versions <module> to list available versionsFor Node.js Projects:
For Container Images:
For Python Projects:
If no version is specified:
If version is specified:
Go Projects:
go mod tidy to update go.sumgo mod vendor if vendor directory existsNode.js Projects:
npm install or yarn installContainer Images:
Python Projects:
make test or equivalentmake buildCreates a Jira ticket with:
Bump {dependency} from {old_version} to {new_version}Creates a pull request with:
[{JIRA-ID}] Bump {dependency} from {old_version} to {new_version}deps/{dependency}-{new_version} or {jira-id}-bump-{dependency}If updates cause issues:
Bump a Go dependency to latest:
/openshift:bump-deps k8s.io/api
Output:
Analyzing dependency: k8s.io/api
Current version: v0.28.0
Latest version: v0.29.1
Checking compatibility...
✅ No breaking changes detected
Updating go.mod...
Running go mod tidy...
Running tests...
✅ All tests passed
Summary:
- Dependency: k8s.io/api
- Old version: v0.28.0
- New version: v0.29.1
- Files modified: go.mod, go.sum
- Tests: ✅ Passed
Changes are ready. Use --create-pr to create a pull request.
Bump to a specific version with Jira ticket:
/openshift:bump-deps golang.org/x/net v0.20.0 --create-jira
Output:
Analyzing dependency: golang.org/x/net
Current version: v0.19.0
Target version: v0.20.0
Reviewing changes...
⚠️ Breaking changes detected in v0.20.0:
- http2: Server.IdleTimeout applies to idle h2 connections
Updating go.mod...
Running tests...
✅ All tests passed
Creating Jira ticket...
✅ Created: OCPBUGS-12345
Summary:
- Jira: https://issues.redhat.com/browse/OCPBUGS-12345
- Dependency: golang.org/x/net
- Version: v0.19.0 → v0.20.0
- Breaking changes: Yes
Bump and create PR in one step:
/openshift:bump-deps github.com/spf13/cobra --create-jira --create-pr
Output:
Processing dependency bump for github.com/spf13/cobra...
[1/7] Analyzing dependency...
Current: v1.7.0
Latest: v1.8.0
[2/7] Checking changelog...
Changes include:
- New features: Enhanced shell completion
- Bug fixes: 5 issues resolved
- No breaking changes
[3/7] Updating files...
✅ go.mod updated
✅ go.sum updated
[4/7] Running tests...
✅ Unit tests: 156/156 passed
✅ Integration tests: 23/23 passed
[5/7] Creating Jira ticket...
✅ Created: OCPBUGS-12346
[6/7] Creating git branch...
✅ Branch: OCPBUGS-12346-bump-cobra
[7/7] Creating pull request...
✅ PR created: #1234
Summary:
- Jira: https://issues.redhat.com/browse/OCPBUGS-12346
- PR: https://github.com/openshift/repo/pull/1234
- Dependency: github.com/spf13/cobra
- Version: v1.7.0 → v1.8.0
- Tests: All passed
Next steps:
1. Review the PR at the link above
2. Address any reviewer comments
3. Merge when approved
Bump multiple related dependencies:
/openshift:bump-deps "k8s.io/*"
Output:
Found 8 Kubernetes dependencies to update:
[1/8] k8s.io/api: v0.28.0 → v0.29.1
[2/8] k8s.io/apimachinery: v0.28.0 → v0.29.1
[3/8] k8s.io/client-go: v0.28.0 → v0.29.1
[4/8] k8s.io/kubectl: v0.28.0 → v0.29.1
...
These should be updated together to maintain compatibility.
Proceed with batch update? [y/N]
Bump a container base image:
/openshift:bump-deps registry.access.redhat.com/ubi9/ubi-minimal
Output:
Analyzing container image: ubi9/ubi-minimal
Current: 9.3-1361
Latest: 9.4-1194
Checking for security updates...
✅ 3 CVEs fixed in new version
Updating Dockerfile...
Building test image...
Running container tests...
✅ All tests passed
Files modified:
- Dockerfile
- .github/workflows/build.yml
$1 (required): Dependency identifier
github.com/org/repo or golang.org/x/net@types/node or reactregistry.access.redhat.com/ubi9/ubi-minimalk8s.io/* (requires confirmation)$2 (optional): Target version
v1.2.3, 1.2.3^1.2.0, ~1.2.0latest, latest-stable--create-jira (flag): Create a Jira ticket for the update
--create-pr (flag): Create a pull request with the changes
--jira-project (option): Specify Jira project (default: auto-detect)
--jira-project OCPBUGS--component (option): Specify Jira component (default: auto-detect)
--component "Control Plane"--branch (option): Specify git branch name (default: auto-generate)
--branch feature/update-deps--skip-tests (flag): Skip running tests (not recommended)
--force (flag): Force update even if tests fail
The command handles common error cases:
git remote -v.gitignore and doesn't commit generated/vendored files unnecessarilyutils:process-renovate-pr - Process existing Renovate dependency PRsgit:create-pr - General PR creation commandjira:create - Manual Jira ticket creation