konflux-ci/Dependency Impact Analysis
Classify dependency PRs by semver bump type, detect risk patterns, and run AI-assisted impact analysis
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Command to run: classify, analyze, both, or merge | yes | both |
| pr-number | Pull request number (not required for merge command with head-sha) | no | 0 |
| github-token | GitHub token for API operations | yes | ${{ github.token }} |
| api-key | LLM provider API key (required for analyze command) | no | — |
| llm-provider | LLM provider: gemini or claude | no | gemini |
| llm-model | LLM model name (provider-dependent default) | no | — |
| auto-approve | Apply approved/lgtm labels and formal APPROVE review for eligible low-risk patches and minors | no | false |
| auto-merge | Merge eligible PRs after analysis when auto-approve labels are present and CI checks pass (requires auto-approve) | no | false |
| dry-run | Suppress all GitHub API writes; log what would happen instead | no | false |
| head-sha | Head SHA to find PRs for (used by merge command with check_suite trigger) | no | — |
| trusted-bots | Comma-separated list of additional trusted bot logins for supply-chain validation (added to defaults: renovate[bot], red-hat-konflux[bot], dependabot[bot]) | no | — |
| suspicious-paths | Comma-separated list of additional suspicious path prefixes for supply-chain validation (added to defaults: .claude/, .vscode/, .github/workflows/, .github/actions/) | no | — |
| expected-files | Comma-separated list of additional expected file patterns for dependency PR scope validation (added to defaults: go.mod, go.sum, vendor/, .tekton/, etc.) | no | — |
Outputs
| name | description |
|---|---|
| bump-type | Detected semver bump type (major/minor/patch/digest/unknown) |
| risk-level | AI-assessed risk level (low/medium/high/unknown) |
| context-json | Path to the assembled context JSON file |