Build an AI Dependency Upgrade Planner with Claude API

pip install anthropic requests

import anthropic
import requests
import subprocess
 
client = anthropic.Anthropic()
 
 
def get_changelog_between_versions(package: str, current: str, target: str) -> str:
    """Pull the actual changelog content between versions — GitHub releases
    API works for most packages hosted there."""
    resp = requests.get(f"https://api.github.com/repos/{get_repo_for_package(package)}/releases")
    releases = resp.json()
    relevant = [r for r in releases if version_between(r["tag_name"], current, target)]
    return "\n\n".join(f"## {r['tag_name']}\n{r['body']}" for r in relevant)
 
 
def find_package_usage(package: str, repo_path: str) -> list[dict]:
    """Find every place in the codebase this package is actually imported and used —
    the specific API surface matters more than 'is it used at all.'"""
    result = subprocess.run(
        ["grep", "-rn", f"import.*{package}\\|from {package}", repo_path, "--include=*.py"],
        capture_output=True, text=True
    )
    return [{"file": line.split(":")[0], "line": line.split(":")[1], "code": line}
            for line in result.stdout.splitlines()]

import json
 
ANALYZE_PROMPT = """Analyze this dependency upgrade for actual risk to our codebase.
 
Package: {package}
Current version: {current_version} -> Target version: {target_version}
 
Changelog between these versions:
{changelog}
 
How our codebase actually uses this package (imports and usage sites):
{usage_sites}
 
Determine:
1. Does the changelog mention any breaking changes that affect APIs
   we actually use (cross-reference against usage_sites, not just
   "there were breaking changes somewhere")
2. Are there deprecated APIs we're using that will be removed in a
   FUTURE version (worth fixing now even if this specific upgrade is safe)
3. What specifically should be tested after upgrading, based on which
   parts of our code touch the changed APIs
4. Recommended sequencing if this is a major bump with multiple breaking
   changes — should it be done in one PR or split into incremental steps
 
Respond with ONLY valid JSON:
{{"safe_to_auto_merge": true/false, "breaking_changes_affecting_us": [...],
  "deprecation_warnings": [...], "specific_test_recommendations": [...],
  "sequencing_advice": "..."}}"""
 
 
def analyze_upgrade(package: str, current: str, target: str, changelog: str, usage_sites: list) -> dict:
    response = client.messages.create(
        model="claude-sonnet-5",
        max_tokens=2000,
        messages=[{
            "role": "user",
            "content": ANALYZE_PROMPT.format(
                package=package, current_version=current, target_version=target,
                changelog=changelog[:6000], usage_sites=usage_sites,
            )
        }]
    )
    text = response.content[0].text.strip()
    if text.startswith("```"):
        text = text.split("```")[1].replace("json", "", 1).strip()
    return json.loads(text)

# .github/workflows/dependency-analysis.yml
name: Dependency Upgrade Analysis
on:
  pull_request:
    types: [opened]
 
jobs:
  analyze:
    if: github.actor == 'renovate[bot]' || github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: python analyze_upgrade.py --pr ${{ github.event.pull_request.number }}
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      # Posts the analysis as a PR comment, turning a bare version-bump PR
      # into one with actual risk context attached