daitasu/cc-deps-patrol
Merge Dependabot PRs with configurable strategies (auto-merge / supply-chain verify + merge / AI review + merge / AI review only) per semver level.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 8, 2026
- License
- MIT
Pinned Snippet
uses: daitasu/cc-deps-patrol@2d4929b66da909eb875822bf6115109c4ec424d2 # v1.3.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| patch-strategy | Strategy for patch version updates. One of: auto-merge, verify-and-merge, review-and-merge, review-only, none. | no | verify-and-merge |
| minor-strategy | Strategy for minor version updates. One of: auto-merge, verify-and-merge, review-and-merge, review-only, none. | no | review-and-merge |
| major-strategy | Strategy for major version updates. One of: auto-merge, verify-and-merge, review-and-merge, review-only, none. | no | review-only |
| github-token | GitHub token for approve and merge operations (e.g. GitHub App token or PAT). | yes | — |
| anthropic-api-key | Anthropic API key for Claude Code AI review. Required when using review-and-merge or review-only strategies. | no | "" |
| claude-github-token | GitHub token for Claude Code Action. Required when using review-and-merge or review-only strategies. | no | "" |
| claude-model | Claude model to use for AI review. | no | sonnet |
| reviewer-login | Bot login name whose review approval to check before merging (e.g. "my-claude-app[bot]"). Used only with review-and-merge strategy. If empty, checks the latest review on the PR. | no | "" |
| review-language | Language for AI review comments (e.g. en, ja). | no | en |
Outputs
| name | description |
|---|---|
| strategy | The strategy that was applied. |
| update-type | The semver update level (patch, minor, major). |
| provenance-result | Supply-chain provenance check result: pass, warn, fail, or skip. |