washogren/Auto-update dependencies
Resolve an npm dist-tag, bump the consumer package.json, render a rich PR body (commits + grouped PRs from the dependency repo), and open a PR via peter-evans/create-pull-request.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| package | The npm package name (e.g. @your-org/your-dependency). | yes | — |
| tag | The dist-tag to track (e.g. dev, staging, prod). | yes | — |
| base-branch | The branch to open the PR against. Defaults to the current ref (GITHUB_REF_NAME). | no | — |
| npm-registry | The npm registry to read from. Defaults to https://npm.pkg.github.com. | no | https://npm.pkg.github.com |
| npm-scope | The npm scope to associate with the registry (e.g. @your-org). Required for scoped packages on GitHub Packages. | no | — |
| node-version | Node.js version used to run npm install. Defaults to 20. | no | 20 |
| token | Token used to read the npm registry, the dependency repository (for the changelog), and to open the PR. Typically a PAT with package:read on the registry, repo:read on the dependency repo, and repo:write on the consumer. | yes | — |
| delete-branch | Whether to delete the auto-update branch when the PR is closed/merged. Forwarded to peter-evans/create-pull-request. | no | true |
| auto-merge | Enable GitHub auto-merge on the PR so it merges once required checks pass. Requires "Allow auto-merge" in repo settings and a branch protection rule / required status check to gate on. | no | false |
| auto-merge-method | Merge method used when auto-merge is enabled: merge, squash, or rebase. | no | squash |
| auto-merge-when-semver | Restrict auto-merge to specific semver change types. A comma-separated list of major, minor, patch. When empty (the default), auto-merge applies to every bump without enforcing semver formatting. When set, both the pinned and resolved versions must be valid semver, and the PR only auto-merges if the change matches one of the listed types (prerelease-only bumps count as patch). | no | "" |
| create-pr-when-semver | Restrict PR creation to specific semver change types. A comma-separated list of major, minor, patch. When empty (the default), a PR is opened for every bump. When set, both the pinned and resolved versions must be valid semver, and a PR is only opened if the change matches one of the listed types (prerelease-only bumps count as patch). A bump whose type is excluded is reported via the changed/semver-change outputs but left for manual handling — e.g. keep majors out of the automated flow with create-pr-when-semver: patch, minor. | no | "" |
Outputs
| name | description |
|---|---|
| changed | true if the dist-tag points to a newer version than what is pinned in package.json; false otherwise. |
| current | The previously-pinned version (the value that was in package.json before the bump). |
| latest | The version the dist-tag now points to. |
| semver-change | The classified bump type: major, minor, or patch. Empty when no semver filter (auto-merge-when-semver / create-pr-when-semver) is set or when there was no change. |
| should-create-pr | true if a PR should be opened for this bump per create-pr-when-semver; false when the bump type is excluded. Empty when there was no change. |
| pr-number | The number of the PR that was created or updated. Empty when no PR was opened. |
| pr-url | The URL of the PR that was created or updated. Empty when no PR was opened. |
| pr-operation | The operation peter-evans performed: created, updated, closed, or none. Empty when no PR was opened. |