How We Automate Dependency Updates, Security Audits, and Test Generation with Claude Code Routines — The Cloud Agent That Runs While We Sleep

TL;DR: Claude Code Routines (launched June 2026) run scheduled terminal agents in the cloud — not CI, not GitHub Actions. We automate: weekly dependency updates + PR, daily security audit + PR, nightly test generation for changed files. All via claude-code routine add --cron. Credit pool covers it. Full routines library →

The Context

Two-dev team, ~120 hrs/mo AI coding. Pre-June 2026: GitHub Actions for dependabot, manual security audits quarterly, test coverage ~65%. Problems: Dependabot PRs often break tests (no context to fix); security audits manual/quarterly; test generation ad-hoc. May 2026: Anthropic announced Claude Code Routines — cloud-scheduled claude-code runs with full repo context, terminal autonomy, PR creation. June 15: General availability.

What We Tested

Automation Approach	Tool	Verdict	Why
Dependabot + GitHub Actions	CI-based	❌	PRs break tests; no context to fix; manual intervention needed
Manual security audit	Human	❌	Quarterly only; misses new CVEs; 4–6 hr effort
Ad-hoc test generation	Developer + cc	⚠️	Inconsistent; only when remembered; coverage plateaued at 65%
Claude Code Routines	Cloud scheduled agent	✅	Full repo context; terminal autonomy; fixes own breaks; PRs ready to review

The Pivot Point

June 18, 2026 (3 days post-GA): Configured first routine — weekly dependency update. claude-code routine add --name "weekly-deps" --cron "0 2 * * 1" --prompt "Update all dependencies, run tests, fix failures, open PR with changes summary". Monday 2 AM: routine ran, updated 47 packages, 3 broke tests, fixed them automatically, opened PR #2341 with diff + test results. We reviewed over coffee, merged. Previous workflow: Dependabot PR → CI fails → dev spends 1–2 hrs fixing → merge. Routines: zero dev time, better outcome.

What We Use Now

Routine Library (configured via claude-code routine add):

Name	Cron	Prompt	Credit Cost (est.)
weekly-deps	0 2 * * 1 (Mon 2 AM)	“Update all npm/pip/cargo deps, run full test suite, fix any failures, open PR with changelog summary”	~15 credits
daily-security	0 3 * * * (Daily 3 AM)	“Run npm audit, pip-audit, cargo audit, check GHSA database, fix any fixable vulns, open PR with CVE details”	~8 credits
nightly-tests	0 1 * * * (Daily 1 AM)	“Find files changed in last 24h via git diff --name-only HEAD~1, generate missing unit/integration tests, run suite, open PR”	~12 credits
monthly-license	0 4 1 * * (1st 4 AM)	“Audit all dependencies for license compatibility (MIT/Apache/BSD only), flag GPL/AGPL, open issue”	~5 credits

Total Monthly Routine Credits: ~40 credits (of 3,000/mo pool) = ~1.3% of budget

Configuration Commands:

# Weekly dependency updates
claude-code routine add \
  --name weekly-deps \
  --cron "0 2 * * 1" \
  --prompt "Update all npm/pip/cargo dependencies. Run full test suite. Fix any test failures automatically. Open PR with changes summary and test results."

# Daily security audit
claude-code routine add \
  --name daily-security \
  --cron "0 3 * * *" \
  --prompt "Run npm audit, pip-audit, cargo audit. Check GitHub Security Advisories. Fix any automatically fixable vulnerabilities. Open PR with CVE details and fix summary."

# Nightly test generation
claude-code routine add \
  --name nightly-tests \
  --cron "0 1 * * *" \
  --prompt "Get files changed in last 24h: git diff --name-only HEAD~1. For each changed source file, generate missing unit/integration tests. Run test suite. Open PR with new tests."

# Monthly license audit
claude-code routine add \
  --name monthly-license \
  --cron "0 4 1 * *" \
  --prompt "Audit all dependencies for license compatibility. Flag any GPL/AGPL/non-permissive licenses. Open GitHub issue with findings and migration suggestions."

Morning Review Protocol (8:30 AM, #dev-ops):

1. Check Routine PRs: gh pr list --author "claude-code[bot]" --state open
2. Review diffs — focus on: test quality, security fix correctness, dependency version jumps
3. Merge if clean; request changes if routine hallucinated
4. Failed routines: claude-code routine logs --name <name> --since 24h → debug, re-run manually if needed

Failure Handling:

• Routine fails → Slack alert #dev-alerts with error + log link
• Common: network flaky, registry down → auto-retry next cron
• Hallucinated fix → revert PR, add to prompt “Do not X”, re-run
• Credit pool near limit → routines pause (pool protects budget)

When You’d Choose Differently

• Simple repos (single language, few deps): GitHub Dependabot + Actions sufficient; routines overkill
• Teams without credit pool: Routines consume credits; pay-per-token API may be cheaper for occasional runs
• Strict compliance requiring human sign-off: Routines open PRs but don’t merge; add required reviewers
• Monorepos with complex build: Routines need fast test feedback (<10 min); slow CI negates autonomy value

Tool Crucible Rating

Dimension	Rating (1–5)	Notes
Overall	4.5	Best automation primitive 2026; replaces brittle CI patterns
Ease of Use	4	claude-code routine add CLI solid; prompt engineering required
Value	5	~40 credits/mo = ~$2 equivalent; saves 10+ hrs dev time/mo
Support	3	Beta (Jun 2026); Discord only; logging could be richer

---

This is part of our AI Coding Tool Evaluation series. See full routines library: Claude Code Routines 2026: Complete Library & Prompts