Skip to main content

​
Overview

The DepFixer GitHub Action analyzes your project’s dependencies on every pull request, posting a detailed report as a PR comment with health score, conflicts found, and fix commands.

​
Quick Start

​
1. Get an API Key

Go to app.depfixer.com/dashboard/api-keys and create a new API key.

​
2. Add Secret to GitHub

In your repository, go to Settings > Secrets and variables > Actions > New repository secret.
  • Name: DEPFIXER_API_KEY
  • Value: Your API key (starts with dfx_live_)

​
3. Create Workflow

Add this file to your repository:
.github/workflows/depfixer.yml
name: Dependency Check
on: [pull_request]

jobs:
  depfixer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depfixer/action@v1
        with:
          api-key: ${{ secrets.DEPFIXER_API_KEY }}
That’s it! DepFixer will now check your dependencies on every PR.

​
Configuration

InputDescriptionDefault
api-keyYour DepFixer API key (required)---
fail-on-conflictsFail the check if conflicts are foundtrue
package-json-pathPath to package.json./package.json
min-health-scoreMinimum health score to pass0
post-commentPost results as PR commenttrue

​
Outputs

OutputDescription
health-scoreThe dependency health score (0-100)
conflicts-countNumber of conflicts found
exit-code0 if passed, 1 if failed

​
Advanced Examples

​
Fail on Low Health Score

- uses: depfixer/action@v1
  with:
    api-key: ${{ secrets.DEPFIXER_API_KEY }}
    min-health-score: 80

​
Custom package.json Path (Monorepo)

- uses: depfixer/action@v1
  with:
    api-key: ${{ secrets.DEPFIXER_API_KEY }}
    package-json-path: ./packages/frontend/package.json

​
Run on Push to Main

name: Dependency Check
on:
  push:
    branches: [main]
  pull_request:

jobs:
  depfixer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depfixer/action@v1
        with:
          api-key: ${{ secrets.DEPFIXER_API_KEY }}

​
Scheduled Weekly Check

name: Weekly Dependency Audit
on:
  schedule:
    - cron: '0 9 * * 1'  # Every Monday at 9 AM

jobs:
  depfixer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depfixer/action@v1
        with:
          api-key: ${{ secrets.DEPFIXER_API_KEY }}
          post-comment: false

​
PR Comment

When post-comment is enabled, DepFixer posts a comment on the PR with:
  • Health score
  • Issue summary by severity (critical, high, medium, low)
  • Detailed conflict list (collapsible)
  • Fix commands (copy-paste ready)
The comment is automatically updated on subsequent pushes to avoid spam.

​
Usage Limits

PlanMonthly Runs
Free50
Pro500
EnterpriseUnlimited
View your usage at app.depfixer.com/dashboard/api-keys.

​
Troubleshooting

​
”Invalid or expired API key”

Verify your secret is set correctly. The key should start with dfx_live_.

​
”Run limit exceeded”

You’ve reached your monthly limit. Upgrade your plan or wait for the monthly reset.

​
Action doesn’t post comment

Ensure the workflow has pull_request trigger and the post-comment input is true (default).