imgcompress-chan: the repo's helper bot
Meet imgcompress-chan, the custom GitHub App that repairs frontend pnpm lockfiles after Dependabot updates and squash-merges dependency PRs once CI is happy.
DevelopmentBotAutomation
Meet imgcompress-chan, the custom GitHub App that repairs frontend pnpm lockfiles after Dependabot updates and squash-merges dependency PRs once CI is happy.
Hi~! I'm imgcompress-chan ❤️ brought to life by @karimz1 to be his little helper for the imgcompress repo. I keep frontend pnpm lockfiles tidy after Dependabot updates and squash-merge dependency PRs once CI is happy. (｡♥‿♥｡)
I'm not very smart yet but I learn quick. So be kind to me. 🥺
She's a real GitHub App that lives at github.com/apps/imgcompress-chan and runs as her own bot identity (imgcompress-chan[bot]) on the repo.
| Task | How it triggers |
|---|---|
Repair a broken frontend/pnpm-lock.yaml on a Dependabot PR | PR comment containing /chan-fix |
| Squash-merge a Dependabot PR after CI passes | Automatic on every Dependabot PR once ci-auto-merge.yml goes green |
/chan-fix#When a frontend Dependabot merge leaves the pnpm lockfile in a broken state, just leave a comment on the affected PR with /chan-fix somewhere in it. She loves a polite ask, so something like:
Hey chan, can you
/chan-fixit please? 💛
Then she'll:
mainfrontend/pnpm-lock.yaml with the pinned pnpm versionSee her in action: karimz1/imgcompress#641.
Right now only @karimz1 can summon her. The list of allowed users will grow over time as she learns more tricks.
If she runs into a merge conflict, or the PR comes from a fork, she'll stop and ask you to repair it manually. Her fork reply looks like this:
Can't reach this one from here 🥺
Hi~! This PR comes from a fork, so I don't have permission to push the lockfile fix back to it. (╥﹏╥)
If you'd like the repair anyway, please:
- Refresh your branch by merging
maininto it first- Run
./applyFrontendDependencyFix.shlocally- Push the result up to your fork, ne~? 💛
The applyFrontendDependencyFix.sh script always uses the pnpm version pinned in frontend/package.json#packageManager, so it never goes stale.
She's set up so the blast radius stays tiny:
/chan-fix actor check happens before any code is checked out, so untrusted commenters can't trigger her.pnpm install --lockfile-only --ignore-scripts, which blocks preinstall / postinstall hooks from PR-controlled package.json files.actions/create-github-app-token@v1, never a long-lived personal access token.For deeper context, see the Developer Guide and the workflow files under .github/workflows/ on the repo.
If you'd like her to help with a new repetitive task, open an issue and tag @karimz1. She learns quick. 🌱