rvagg/depsound

Review dependency changes on a PR with depsound and upload the report. Evidence, never a verdict.

Trust Signals

name	description	required	default
manifests	Newline-separated manifest/lockfile base names to watch on a PR, matched at any path (monorepo nested files included). Lockfiles are exact and transitive; the declaration files (package.json / Cargo.toml) are the labelled fallback for repos that commit no lockfile, and a directory whose lockfile also changed defers to it. go.mod is both declaration and resolution. github-actions manifests (.github/workflows/*.yml and composite action.yml/action.yaml) are always detected regardless of this list, from their pinned `uses:` refs.	no	go.mod package-lock.json pnpm-lock.yaml Cargo.lock package.json Cargo.toml pnpm-workspace.yaml
deps	Override: a newline-separated depsound list to review (`<eco>:<name> <from> <to>` bump, `<eco>:<name> <version>` new dep, or `redirect <eco>:<name> <target>`). When set, PR detection is skipped. Eco is npm, go, crates, gha.	no	""
depsound-version	The depsound release tag to download and pin.	no	v0.31.0
depsound-sha256	sha256 of the release asset for this runner's platform, an independent anchor supplied by the caller. Required when depsound-version is overridden to a release without build-provenance attestations; ignored otherwise (attestation verification is the default anchor).	no	""
cooldown	Days, forwarded to depsound --cooldown to match an install cooldown.	no	""
github-token	Token used to download the pinned depsound release (and checkout the PR to diff its manifests).	no	${{ github.token }}

name	description
markdown	The PR-comment markdown body rendered by depsound.
title	One-line check title.
tripped	true unless the headline reads 'no signals tripped'.