mfranzke/Dependabot Review
Prepare local review prompts or automate reviews for Dependabot updates
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 12, 2026
- License
- Apache 2.0
Pinned Snippet
uses: mfranzke/dependabot-review-action@f978694098c8d903eaeb3d4d5b02e25d1c31fe63 # v0.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token with permission to read the PR and publish review comments | yes | — |
| review-mode | Review mode, either prompt or openai | — | prompt |
| openai-api-key | OpenAI API key, required when review-mode is openai | no | — |
| openai-model | Exact OpenAI API model ID, required when review-mode is openai | no | — |
| openai-base-url | OpenAI-compatible API base URL | — | https://api.openai.com/v1 |
| gitlab-token | Optional GitLab token for private upstream projects | no | — |
| create-fix-pr | Create or refresh a remediation PR when changes are required | — | false |
| max-context-characters | Maximum repository context sent to the model | — | 600000 |
| exclude | Newline-separated repository path globs to exclude | no | — |
Outputs
| name | description |
|---|---|
| review-comment-url | URL of the maintained review comment |
| risk-level | Overall risk level in openai mode; empty in prompt mode |
| fix-required | Whether openai mode found required code changes; empty in prompt mode |
| fix-pr-url | URL of the remediation PR, when created |
| dependencies-reviewed | Number of dependency updates reviewed |