soderlind/gh-bump
AI-powered Dependabot security fix agent. Analyzes code with LLM, applies fixes via GitHub API, creates PRs.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token with repo and security_events scope | yes | ${{ github.token }} |
| ai-provider | AI provider: openai, anthropic, or github (uses github-token, no separate key needed) | no | github |
| ai-api-key | API key for the AI provider (not needed for github provider) | no | — |
| ai-model | AI model name override | no | — |
| repo | Target repository (owner/repo). Defaults to current repo. | no | ${{ github.repository }} |
| severity | Minimum alert severity to process: critical, high, medium, low | no | — |
| dry-run | Preview mode — no changes will be made | no | false |
| merge | Merge PRs after creation | no | false |
| merge-method | Merge method: squash, merge, rebase | no | squash |
| release | Create GitHub release after merge (implies merge) | no | false |
| tag | Create git tag after merge (implies merge) | no | false |
| max-alerts | Maximum alerts to process per run | no | 10 |
| max-llm-calls | Maximum LLM calls per run (cost guardrail) | no | 20 |
| verbose | Enable debug output | no | false |
Outputs
| name | description |
|---|---|
| prs-created | Number of PRs created |
| alerts-fixed | Number of alerts processed |
| no-fix | Number of alert groups that produced no fix plan |
| budget-stops | Number of alert groups stopped by configured budget limits |
| failed | Number of alert groups that failed during processing |
| pr-urls | JSON array of PR URLs |
| summary | Human-readable summary |