How Sunset works
For anyone who wants to know what's actually happening before they install a GitHub App on their org.
Detection
Sunset scans each connected repo using an AST parser, not a regex search, because regex misses the real-world case: most teams don't call the Shopify Admin API directly, they call it through their own service layer, a wrapper class, a couple of helper functions three files deep. Sunset follows the call graph through that wrapper and records every actual call site, along with the API version each one resolves to, whether that's set at client init, per-request, or left at an account default.
Matching
Shopify publishes its own deprecation and sunset schedule for every quarterly API version. Sunset maps your detected call sites against that schedule and only raises something when a call site actually touches a field, type, or endpoint that's changing. A newer version being available isn't itself a flag; your code actually depending on what's going away is.
Migration
For each real match, Sunset writes the migration: the code change needed to move that call site from the sunsetting version to a supported one, using the affected field's canonical replacement and Shopify's own migration guidance as grounding, not just general knowledge of the API.
Verification
The migration gets applied to an isolated branch and run against your repo's own test suite, pointed at the new API version. Green tests are the gate; nothing gets proposed to you without passing your own tests first. Where a call site is ambiguous (an API version set dynamically, a helper used in more than one context), Sunset marks it low-confidence and says so in the report rather than guessing at a fix.
The draft PR
If verification passes, Sunset opens a draft pull request with the diff and a one-page report: what's breaking and when, the Shopify changelog citation it's working from, every call site touched, the test result, and a confidence score. You review and merge it the way you'd review a PR from any other contributor. It never merges itself.
What Sunset is not
It's not Dependabot. Dependabot watches the packages in your manifest; that's a solved problem and GitHub owns it. Sunset watches the providers outside your manifest entirely, the ones you call over HTTP that no repo host tracks because they live outside your dependency tree.
If your problem is an outdated npm package, you already have a tool for that.