lzap/gobump-deps
Bump Go project dependencies using lzap/gobump and open a PR
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 29, 2026
- License
- BSD
Pinned Snippet
uses: lzap/gobump@791c51109f2afbdd792882c29311775ce1dcbea7 # v1.0.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| go_version | Go version to use when setup_go is true (defaults: stable) | no | stable |
| cgo_enabled | Enable CGO environment variable | no | 0 |
| token | GitHub token with permissions to push branches and open PRs; also used for optional changelog Gist (GITHUB_TOKEN / GH_TOKEN in the step environment) | yes | — |
| exec | String to pass via gobump -exec argument (no shell expansion) | no | — |
| exec2 | Additional string to pass via gobump -exec argument (no shell expansion) | no | — |
| labels | Comma-separated list of labels to add to the PR | no | — |
| tidy | Deprecated, ignored. gobump runs go mod tidy before each per-dependency commit (git mode) or leaves go.mod/go.sum as updated (no-git mode). | no | true |
| exec_pr | Deprecated, ignored. Previously ran a command before the PR step and appended output to the commit message. | no | — |
| setup_go | Set up Go environment (default: true) | no | true |
| pr | Create a pull request with the changes | no | true |
| development | Run in development mode and build from the current repo (default: false) | no | false |
| changelog | Fetch upstream git changelogs for updated modules. With per-dependency commits (default), each bump commit includes its module changelog; with -no-git, changelogs are written to changelog-dest for the PR message instead | no | false |
| include | Space-separated list of modules to update (default: all) | no | — |
| exclude | Comma-separated list of modules to exclude from update | no | — |
| commit_message | Commit message for the PR other than 'chore: bump dependencies via gobump' | no | chore: bump dependencies via gobump |
| no_git | If true, skip all gobump git operations (no per-dependency commits or reset/clean on failure). When false (default), each successful bump may be committed as chore(deps): update … when the work tree has no uncommitted changes. | no | false |
| user_name | Git user.name for per-dependency commits (passed to gobump -user-name) | no | Schutzbot |
| user_email | Git user.email for per-dependency commits (passed to gobump -user-email) | no | schutzbot@gmail.com |
Outputs
no outputs