1. Decide what to upgrade
Gilfoyle reads the manifest, lockfile and your upgrade policy: which packages, how far and what waits. Release notes and migration guides are checked for breaking changes before anything moves.
Upgrade dependencies safely
Gilfoyle prepares dependency upgrades as small, tested pull requests, with release notes read, breaking changes handled and your checks rerun.
dependencies
Example brief · Hypothetical workflow
Your brief
Upgrade our date library to the current major version. Read the migration guide, fix what it breaks and keep it to one reviewable PR.
GilfoyleAPP
I’ll check what the new major version changes, find where we rely on it and prepare a tested upgrade PR.
See example output ↓How Gilfoyle handles it.
Starts: On the schedule you choose, or when an advisory or release notice names a package you use.
2. Upgrade in small, tested steps
With connected Claude Code or Codex and GitHub, Gilfoyle updates the package with your package manager, changes the call sites the release notes and type errors point to, and runs the build and the tests that cover them. Unrelated upgrades stay out of the same PR.
3. Hand over a reviewable draft PR
The draft PR lists the version change, the breaking changes that applied, the code that changed and the checks that ran. An upgrade that needs a product decision or a long migration comes back as a plan instead of a half-finished branch.
An upgrade you can review in one sitting.
This workflow keeps individual packages current. Moving a large codebase to a new framework or API fits the code-migration workflow better.
Hypothetical finished result
Example output
Date-library upgrade PR
Hypothetical: a team moves its date library up one major version.
- Release notes
- Two breaking changes apply: week-year format tokens changed, and parsing no longer accepts ambiguous two-digit years. A third, dropped support for an old Node version, does not affect the pinned runtime.
- Change
- Eleven call sites move to the new format tokens and one removed helper is replaced. The lockfile diff touches only the date library and its own dependency.
- Checks
- The build, type check and date-formatting tests pass. A new test covers the two-digit-year input that now needs explicit handling, and the PR asks the reports owner to confirm that behavior.
The apps this job needs.
Connect the accounts and actions for your workflow. Start in Artie or add your Artisan to Slack; access stays within your account permissions.
Explore apps- GitHub
- Connect the repository and allow branches and pull requests. Name the required reviewers and any packages that need an owner’s sign-off.
- Claude Code or Codex
- Connect the coding tool and provide an environment where install, build and tests can run.
Questions about this workflow
Does Gilfoyle merge upgrades that pass?
No. Upgrades arrive as draft PRs for your required reviewers. Passing checks show what was tested, not that every runtime path is covered.
How are security advisories handled?
When advisories are part of the brief, Gilfoyle checks whether the affected version and code path are actually in use and says so in the draft PR.
What about upgrades that break a lot?
Gilfoyle stops at a plan: the breaking changes, the affected areas and a suggested order. You decide whether it becomes a migration.