Reads the lockfile (Gemfile.lock by default) diff and posts comments with the output from gem compare and gem compare --diff for the gems that changed version.
Uses https://rubygems.org/gems/skillnad (https://github.com/dentarg/skillnad).
To use in your repo, add a workflow like this:
name: Gem Compare
on:
pull_request_target:
types:
- opened
- reopened
permissions:
contents: read
pull-requests: write
jobs:
compare:
if: github.actor == 'dependabot[bot]' && startsWith(github.head_ref, 'dependabot/bundler/')
runs-on: ubuntu-latest
steps:
- uses: dentarg/gem-compare@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}The if above matters: with pull_request_target the job has a write token, so keep it to pull requests from your own repository or Dependabot. The action only reads the pull request's files, and runs nothing from its checkout.
With the above workflow, to re-run the action, have Dependabot close and re-open the pull request:
gh pr comment --body '@dependabot close' NUM
gh pr comment --body '@dependabot reopen' NUM