ryanramage/Dependency Change Report
Generate a dependency change report for a (private) repo against its last release line, configure private npm auth, and publish report.json to a durable central reports repo for cross-project comparison.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| node-version | Node.js version for the runner. | no | 18 |
| cli-version | Version (npm dist-tag or semver range) of dependency-change-report to run via npx. Leave empty (default) to run the CLI bundled at this action's git ref, which needs nothing published to npm. | no | "" |
| base-ref | Explicit "older" baseline ref. If set, overrides .dcr.json and auto-detection. Leave empty to let the CLI resolve it (.dcr.json baseline, else latest stable tag). | no | "" |
| config-file | Path to the .dcr.json config file holding a pinned baseline. | no | .dcr.json |
| github-packages-scopes | Comma-separated npm scopes hosted on GitHub Packages, e.g. "@company,@company-internal". Each is mapped to npm.pkg.github.com. | no | "" |
| github-packages-token | Token used to read GitHub Packages. Defaults to the job token, but for packages published from other repos provide an org PAT / App token with packages:read. | no | ${{ github.token }} |
| ignore-dev | Set "true" to force --ignore-dev. Leave empty to defer to the repo's .dcr.json (ignoreDev). | no | "" |
| output-dir | Directory for generated reports. | no | ./dcr-reports |
| publish-target | Where to publish report.json: central-repo | artifact | none. | no | central-repo |
| reports-repo | owner/name of the central reports repo (publish-target=central-repo). | no | "" |
| reports-branch | Branch in the reports repo to commit to. | no | main |
| reports-token | Token with contents:write on the reports repo. | no | "" |
| product | Product/path prefix in the reports repo, e.g. "acme". | no | "" |
| repo-kind | This repo kind: electron | react-native (used in the report path). | no | "" |
| comment-on-pr | Post/update the markdown report as a PR comment. | no | true |
| comment-token | Token used for the PR comment API. | no | ${{ github.token }} |
| fail-on | Fail the job on changes: none | major | any. | no | none |
Outputs
| name | description |
|---|---|
| has-changes | true if any dependency changed. |
| added-count | Number of added dependencies. |
| upgraded-count | Number of upgraded dependencies. |
| removed-count | Number of removed dependencies. |
| older-version | Resolved baseline ("older") ref. |
| newer-version | Resolved current ("newer") ref. |
| report-json-path | Absolute path to the generated report.json. |
| report-path | Path of report.json committed to the central reports repo (if published). |