| app-client-id | GitHub App client ID for authentication | yes | — |
| app-private-key | GitHub App private key (PEM format) | yes | — |
| branch | Branch name for dependency update PR | no | pnpm/config-deps |
| source-branch | Branch the dependency update branch is created from (and reset to on each
run). The pull request also targets this branch unless target-branch
overrides it.
| no | main |
| target-branch | Branch the pull request merges into. Leave empty to follow source-branch;
set it only to target a different branch than the one the update was cut
from (e.g. cut from dev but PR into main).
| no | "" |
| config-dependencies | Config dependencies to update (one per line, exact match).
Example:
@savvy-web/pnpm-plugin-silk
typescript
| no | "" |
| dependencies | Dependencies to update (one per line, supports globs).
Matches against dependencies, devDependencies, and optionalDependencies
in all workspace package.json files (peerDependencies are managed via
peer-lock / peer-minor).
Example:
vitest
@savvy-web/*
| no | "" |
| peer-lock | Dependencies whose peerDependency range syncs on every version bump.
Explicit package names only (no globs). Must also match a dependencies pattern.
Example:
vitest-agent-reporter
| no | "" |
| peer-minor | Dependencies whose peerDependency range syncs only on minor+ version bumps.
Explicit package names only (no globs). Must also match a dependencies pattern.
Example:
vitest
@vitest/coverage-v8
| no | "" |
| upgrade-package-manager | Upgrade the package manager detected for this workspace (pnpm, bun or
npm) in the packageManager and devEngines.packageManager fields.
corepack-managed managers (pnpm, npm) are written as a hash-pinned
version (e.g. pnpm@11.0.0+sha512.<hex>); bun is written as a bare version,
because corepack does not manage bun.
Values: false (skip), true/auto (latest within the current major,
favoring the devEngines version), or a semver range (e.g. ^11) to move
to and add when no packageManager field exists. An explicit range must be
a range for the DETECTED package manager — a pnpm range in a bun repo
satisfies nothing and is skipped with a warning.
| no | true |
| upgrade-runtime-node | Upgrade the Node.js entry in devEngines.runtime. Only ever upgrades an
entry the manifest already declares — it never adds one, and skips with a
warning when no entry exists.
Values: false (skip), auto (resolve latest within the existing range,
no-op for static pins), or a semver range (e.g. ^22) selecting the line to
resolve. The resolved version is always written EXACT (no range operator),
because downstream consumers of devEngines.runtime do not support ranges.
| no | false |
| upgrade-runtime-deno | Upgrade the Deno entry in devEngines.runtime.
Values: false (skip), auto, or a semver range (e.g. ^2). See
upgrade-runtime-node for semantics.
| no | false |
| upgrade-runtime-bun | Upgrade the Bun entry in devEngines.runtime.
Values: false (skip), auto, or a semver range (e.g. ^1). See
upgrade-runtime-node for semantics.
| no | false |
| runtime-data | Data source for runtime version resolution.
- offline: bundled runtime-resolver cache only (no network)
- live: fetch latest data, falling back to the bundled cache on failure
| no | offline |
| dry-run | Run without making changes (for testing) | no | false |
| run | Commands to run after dependency updates (one per line).
Useful for running linting, tests, or build commands after updates.
Example:
pnpm lint:fix
pnpm test
| no | "" |
| changesets | Create changesets for version management when .changeset/ directory exists | no | true |
| timeout | Maximum time in seconds for the main action to run before cancelling.
Prevents the action from hanging indefinitely on slow installs or commands.
| no | 180 |
| auto-merge | Enable auto-merge on the dependency update PR.
Requires branch protection with required status checks.
Values: merge, squash, rebase, or empty to disable.
| no | "" |