morinokami/depvisor
Reviews an existing Dependabot or Renovate PR, fixes CI breakage with an AI coding agent, verifies the fix, and posts an evidence-based report.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 11, 2026
- License
- MIT
Pinned Snippet
uses: morinokami/depvisor@f76f7c6306e47944fa5d08e497ffcfcdabf816ce # v1.3.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| llm_api_key | LLM provider API key. | no | "" |
| llm_model | Model specifier, for example openai/gpt-5.5. | no | "" |
| llm_api_key_env | Environment variable name used for llm_api_key; inferred for known providers. | no | "" |
| github_token | Token used only to read the triggering CI run and publish to the existing PR. | no | ${{ github.token }} |
| node_version | Node version used to run depvisor itself. | no | 24 |
Outputs
| name | description |
|---|---|
| status | reviewed, already-reviewed, fix-pushed, deferred, unsupported-pr, or a failing status. |
| failed | "true" when depvisor could not safely complete the review or publication. |
| fix_pushed | "true" when depvisor pushed a fix commit to the updater PR. |
| pr_url | URL of the updater PR. |
| commit_sha | SHA of the pushed fix commit, or empty when no fix commit was pushed. |
| comment_url | URL of depvisor's maintained reviewer-report comment. |
| total_tokens | Total model tokens used by the agent. |
| est_cost_usd | Provider-priced estimated model cost in USD. |