| base-ref | Base git ref (branch, tag, or SHA). Auto-detected from GITHUB_BASE_REF in CI. In git mode (no pr-number), defaults to HEAD~1.
| no | — |
| head-ref | Head git ref. Auto-detected from GITHUB_HEAD_REF in CI. In git mode, defaults to HEAD.
| no | — |
| pr-number | GitHub PR number. Uses the PR's exact base and head commit SHAs via the gh CLI, which avoids branch timing issues. Typically set to github.event.pull_request.number.
| no | — |
| repo | GitHub repository in OWNER/NAME format. Auto-detected from GITHUB_REPOSITORY if omitted.
| no | — |
| lockfile | Specific lockfile path to compare. When omitted, all lockfiles in the repository are auto-discovered (monorepo-aware).
| no | — |
| type | Force lockfile type: uv, poetry, pdm. Only used together with the lockfile input.
| no | — |
| filters | YAML map of named package groups. Each group produces a boolean output named after the group, set to 'true' if any package in the group changed. Inspired by dorny/paths-filter. May be combined with filters-from; inline definitions take precedence over the file on key collision. Example:
auth:
- pyjwt
- cryptography
http-client:
- httpx
- requests
| no | — |
| filters-from | Path to a YAML file containing named package group filters (same format as the filters input). Merged with any inline filters; the inline filters input takes precedence on key collision. Inspired by dorny/paths-filter's filters-from.
| no | — |
| markdown | Set to 'true' to generate a markdown summary of changes. The summary has three sections (Added, Changed, Removed). Direct prod dependencies are **bold**, dev dependencies are *italic*, transitive deps are plain.
| no | false |
| json-to-file | File path to write the JSON diff report to. When set, the full report is also written to this path in addition to being emitted as the `diff` output.
| no | — |
| markdown-to-file | File path to write the markdown summary to. Requires markdown: 'true'.
| no | — |
| post-comment | Controls PR comment posting. 'true' always posts or updates a comment. 'if-changed' posts only when at least one dependency changed (silent skip when nothing changed). 'false' never posts. Uses the GitHub REST API; updates an existing lockdelta comment on re-runs. PR number is auto-detected from the event payload on pull_request events. The markdown summary is generated even if markdown: 'false'.
| no | false |