stacktower-io/Stacktower Dependency Diff

Visualize dependency changes on pull requests with before/after tower diffs

Trust Signals

name	description	required	default
api-key	Stacktower Cloud API key (from app.stacktower.io/settings)	yes	—
manifest	Path to manifest file (auto-detected if omitted)	no	—
fail-on-vuln	Fail the check if new vulnerabilities are introduced	—	false
fail-on-license	Fail the check if copyleft, proprietary, or unknown licenses are detected in the after render	—	false
fail-on-brittle	Fail the check if brittle (archived/abandoned/undermaintained) dependencies are detected in the after render	—	false
security-scan	Run vulnerability scan on dependencies	—	true
investigate	Run the Triage AI agent for health grade and recommendations (requires Pro)	—	false
comment	Post a PR comment with the diff	—	true
token	GitHub token for PR comments and investigation repo access	—	${{ github.token }}
api-base-url	Stacktower API base URL (override for testing)	—	https://api.stacktower.io/v1
app-base-url	Stacktower app base URL (override for testing)	—	https://app.stacktower.io

name	description
diff-json	JSON diff result
has-changes	Whether dependency changes were detected
new-vulns	Number of new vulnerabilities introduced
before-render-id	Render ID for the before tower
after-render-id	Render ID for the after tower
before-url	URL to the before tower on app.stacktower.io
after-url	URL to the after tower on app.stacktower.io
license-issues	Number of license issues (copyleft + proprietary + unknown) in the after render
brittle-deps	Number of brittle dependencies in the after render
health-grade	Dependency health grade (A-F) from the Triage AI investigation
investigation-json	Full Triage AI investigation report as JSON