GitHub Action

Renovate or Dependabot opens a pull request. The Action runs radius on it and posts a comment: the answer for each changed dependency, and the lines to check. On every new push, it updates the same comment. Pull requests that change no dependency get no comment.

Set it up with Renovate or Dependabot

Add this file to the repository. It works the same for Renovate and Dependabot.

name: dep-radius

on:
  pull_request:
    paths:
      - "**/package.json"
      - "**/package-lock.json"
      - "**/pnpm-lock.yaml"
      - "**/yarn.lock"
      - "**/bun.lock"

permissions:
  contents: read
  pull-requests: write

jobs:
  brief:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: prakticode/dep-radius@v0

That's all. No install step: radius reads the lockfile. What each part does:

• pull_request runs it on every pull request, from a bot or a person. The paths filter is optional. It skips pull requests that can't change a dependency. Without it, a pull request that changes no dependency still gets no comment.
• pull-requests: write lets the job post the comment. Workflows started by Dependabot get a read-only token by default, and this key is how GitHub lets you raise it. Renovate pull requests get the usual token. No secret is needed.
• actions/checkout with its default settings is enough. The Action fetches the one base commit it needs, so there is no need for fetch-depth: 0.
• @v0 follows every 0.x release. See pinning below.

Only on pull requests from the bots

To skip pull requests opened by people, add a condition on the author:

jobs:
  brief:
    if: >-
      github.event.pull_request.user.login == 'renovate[bot]' ||
      github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest

This checks who opened the pull request, not github.actor, which is whoever pushed last. A person who pushes a fix to a Renovate branch still gets the comment. A self-hosted Renovate uses the login of its own bot account: use that login instead.

Forks and pull_request_target

Renovate and Dependabot push their branches to your repository, so their pull requests are not forks. A pull request from a fork gets a read-only token that the workflow can't raise. There, the Action shows a warning, doesn't fail, and the result is in the job summary.

Don't switch to pull_request_target to comment on forks. It gives the job a write token. To read the pull request, the job would have to check out its files, and the Action runs npx inside them. A .npmrc in those files can point npm at another registry, so the pull request would choose the code that runs with your token. With pull_request, that risk is gone: a fork only gets a read-only token, and a branch in your repository was pushed by someone who already has write access.

What you get

• A comment: a table of the changed dependencies and their answers, then a section for each one to check, with files and lines.
• The job summary: the same content, even when commenting isn't allowed.
• A failing check when something your code uses was removed. You can change this with fail-on.
• Outputs you can use in later steps, for example to auto-merge quiet updates.

Inputs

Outputs

Recipes

Be strict: fail on review too

- uses: prakticode/dep-radius@v0
  with:
    fail-on: review

Auto-merge quiet updates from Renovate

permissions:
  contents: write
  pull-requests: write

jobs:
  brief:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - id: radius
        uses: prakticode/dep-radius@v0
      - if: steps.radius.outputs.verdict == 'quiet' && github.event.pull_request.user.login == 'renovate[bot]'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          GH_TOKEN: ${{ github.token }}
          PR_URL: ${{ github.event.pull_request.html_url }}

--auto merges only once your required checks pass, and it needs "Allow auto-merge" turned on in the repository settings.

A project in a subfolder

- uses: prakticode/dep-radius@v0
  with:
    working-directory: packages/api

Use the JSON in a later step

- id: radius
  uses: prakticode/dep-radius@v0
  with:
    comment: false
- run: jq '.summary' "${{ steps.radius.outputs.json }}"

Good to know

• Dependabot and forks. Dependabot pull requests can be commented on once the job has pull-requests: write. Pull requests from forks can't, see forks. The result is in the job summary either way.
• Pinning. @v0 follows every 0.x release. To pin exactly, use a full tag like @v0.2.0, or set version.
• Node.js. If the runner's Node is older than 22.18, the Action sets up Node 24 for its own steps.
• Every changed version is listed, even ones the pull request title doesn't mention. See does this pull request change more than it says?
• Nothing runs from the pull request. radius reads files. It never installs packages or runs scripts from the branch it analyses.