Release automation · 2026 · Solo — trend research, GitHub transaction architecture, graph policy, test-first implementation, interaction design, verification, deployment
Bumpdock
A narrowly authorized release-intent operator that maps changed workspaces, propagates dependent bumps, and writes only when the live pull-request head still matches review.
The problem
A maintainer of a Changesets-enabled npm workspaces monorepo can receive a pull request that changes packages without declaring release intent. Finding the affected workspaces, following internal dependency edges, choosing semver bumps, formatting frontmatter, and writing against the exact live head is repetitive and race-prone. Bumpdock turns that bounded review into one deterministic `.changeset/bumpdock-pr-<number>.md` commit. It cannot merge, publish, tag, release, rewrite source files, store credentials, or act in the background.
Architecture
Key decisions
Bind authority to the state a person reviewed
Every content read is pinned to the reviewed head SHA. The write path rechecks repository ID, open/unmerged PR state, base and head identity, branch ref, target-path absence, and a final PR snapshot before createCommitOnBranch uses expectedHeadOid. If any identity changes, Bumpdock stops instead of adapting silently.
Bound the package graph instead of approximating every monorepo
The operator accepts one-level npm workspace patterns, 1–30 matched packages, 1–100 changed files, workspace:* runtime or optional internal edges, and Changesets configurations without fixed or linked groups. Unsupported peer/dev edges, private or ignored workspaces, malformed manifests, truncated trees, and ambiguous policy fail closed.
Treat renames as changes on both sides
A cross-workspace rename can require release intent for both the source and destination packages. Compare responses marked renamed must include previous_filename; the planner maps both paths before dependency propagation, preventing a move from silently omitting the source package.
Prove the exact-head production transaction
GitHub first recorded a successful production deployment for code-equivalent main SHA bed1b0feb1700460932c9db5ee385577656a6f89. That live deployment loaded same-repository sandbox pull request #1, reviewed head eef1859b742137a7bd5b4cd61d51ed83995eb7f5, and atomically created `.changeset/bumpdock-pr-1.md` at new head d8ee47e92e7368f99dfbb19d71ccede8dca5b623. Desktop and mobile overflow were zero, with zero console or page errors. Evidence-only main SHA 4974281919582cb3b73f6f75587d4759d2cd2fae subsequently recorded those artifacts and received its own successful GitHub-to-Vercel deployment status.
Translate graph demand into a bounded release action
Secure radar run 20260806T214542-0700-github-star-radar-a5cd5a8f observed tirth8205/code-review-graph at daily rank 9 with 237 stars that day and 29,121 total on 2026-08-06 after higher-ranked adjacencies failed fixed feasibility, originality, or recent-duplicate gates. Bumpdock translates demand for repository graphs into a release action without copying source code, AST analysis, graph visualization, branding, or affiliation.