> ## Documentation Index
> Fetch the complete documentation index at: https://docs.depfixer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Action

> Automatically check dependencies on every pull request

## Overview

The DepFixer GitHub Action analyzes your project's dependencies on every pull request, posting a detailed report as a PR comment with health score, conflicts found, and fix commands.

## Quick Start

### 1. Get an API Key

Go to [app.depfixer.com/dashboard/api-keys](https://app.depfixer.com/dashboard/api-keys) and create a new API key.

### 2. Add Secret to GitHub

In your repository, go to **Settings > Secrets and variables > Actions > New repository secret**.

* **Name**: `DEPFIXER_API_KEY`
* **Value**: Your API key (starts with `dfx_live_`)

### 3. Create Workflow

Add this file to your repository:

```yaml .github/workflows/depfixer.yml theme={null}
name: Dependency Check
on: [pull_request]

jobs:
  depfixer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depfixer/action@v1
        with:
          api-key: ${{ secrets.DEPFIXER_API_KEY }}
```

That's it! DepFixer will now check your dependencies on every PR.

## Configuration

| Input               | Description                           | Default          |
| ------------------- | ------------------------------------- | ---------------- |
| `api-key`           | Your DepFixer API key (required)      | ---              |
| `fail-on-conflicts` | Fail the check if conflicts are found | `true`           |
| `package-json-path` | Path to package.json                  | `./package.json` |
| `min-health-score`  | Minimum health score to pass          | `0`              |
| `post-comment`      | Post results as PR comment            | `true`           |

## Outputs

| Output            | Description                         |
| ----------------- | ----------------------------------- |
| `health-score`    | The dependency health score (0-100) |
| `conflicts-count` | Number of conflicts found           |
| `exit-code`       | 0 if passed, 1 if failed            |

## Advanced Examples

### Fail on Low Health Score

```yaml theme={null}
- uses: depfixer/action@v1
  with:
    api-key: ${{ secrets.DEPFIXER_API_KEY }}
    min-health-score: 80
```

### Custom package.json Path (Monorepo)

```yaml theme={null}
- uses: depfixer/action@v1
  with:
    api-key: ${{ secrets.DEPFIXER_API_KEY }}
    package-json-path: ./packages/frontend/package.json
```

### Run on Push to Main

```yaml theme={null}
name: Dependency Check
on:
  push:
    branches: [main]
  pull_request:

jobs:
  depfixer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depfixer/action@v1
        with:
          api-key: ${{ secrets.DEPFIXER_API_KEY }}
```

### Scheduled Weekly Check

```yaml theme={null}
name: Weekly Dependency Audit
on:
  schedule:
    - cron: '0 9 * * 1'  # Every Monday at 9 AM

jobs:
  depfixer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depfixer/action@v1
        with:
          api-key: ${{ secrets.DEPFIXER_API_KEY }}
          post-comment: false
```

## PR Comment

When `post-comment` is enabled, DepFixer posts a comment on the PR with:

* Health score
* Issue summary by severity (critical, high, medium, low)
* Detailed conflict list (collapsible)
* Fix commands (copy-paste ready)

The comment is automatically updated on subsequent pushes to avoid spam.

## Usage Limits

| Plan       | Monthly Runs |
| ---------- | ------------ |
| Free       | 50           |
| Pro        | 500          |
| Enterprise | Unlimited    |

View your usage at [app.depfixer.com/dashboard/api-keys](https://app.depfixer.com/dashboard/api-keys).

## Troubleshooting

### "Invalid or expired API key"

Verify your secret is set correctly. The key should start with `dfx_live_`.

### "Run limit exceeded"

You've reached your monthly limit. Upgrade your plan or wait for the monthly reset.

### Action doesn't post comment

Ensure the workflow has `pull_request` trigger and the `post-comment` input is `true` (default).