Dependency reviews in your CI

Run it in the job the Gerrit Trigger plugin starts on patchset-created. The trigger sets the change, project and patch set; the review is posted as a message on the patch set, with no vote.

pipeline {
  agent { docker { image 'ghcr.io/mbobiosio/depdelta-cli:latest' } }
  stages {
    stage('DepDelta') {
      steps {
        withCredentials([
          string(credentialsId: 'depdelta-api-key', variable: 'DEPDELTA_API_KEY'),
          usernamePassword(credentialsId: 'gerrit-http',
                           usernameVariable: 'GERRIT_HTTP_USER',
                           passwordVariable: 'GERRIT_HTTP_PASSWORD'),
        ]) {
          // A DepDelta outage shouldn't fail the build.
          catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') {
            sh 'depdelta'
          }
        }
      }
    }
  }
}

DEPDELTA_API_KEY

Your API key, from Settings.

GERRIT_HTTP_USER

The Gerrit account that posts (a service account works best).

GERRIT_HTTP_PASSWORD

That account's HTTP password, from its Gerrit settings.

Run it in merge request pipelines. The review is one note on the merge request, edited in place on every push; uses link to the files at the head commit.

depdelta:
  image: ghcr.io/mbobiosio/depdelta-cli:latest
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    GIT_DEPTH: 0
  script:
    - depdelta
  allow_failure: true

DEPDELTA_API_KEY

Your API key, from Settings.

GITLAB_TOKEN

A project access token with the api scope (Reporter is enough). CI_JOB_TOKEN can't write notes.

For Codeberg, self-hosted Forgejo and Gitea (Gitea Actions: .gitea/workflows/depdelta.yml). The review is one pull request comment, edited in place on every push. On a pull request from a fork the workflow's token is read-only, so the review can't be posted there.

on: pull_request

jobs:
  depdelta:
    runs-on: docker
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: DepDelta
        # A DepDelta outage shouldn't fail the pull request.
        continue-on-error: true
        env:
          DEPDELTA_API_KEY: ${{ secrets.DEPDELTA_API_KEY }}
          FORGEJO_TOKEN: ${{ github.token }}
        run: |
          curl -LsSf https://astral.sh/uv/install.sh | sh
          ~/.local/bin/uvx --from depdelta-cli depdelta

DEPDELTA_API_KEY

Your API key, from Settings.

FORGEJO_TOKEN

The workflow's own token is enough. GITEA_TOKEN works too.

Woodpecker CI on a Forgejo or Gitea forge. The review is one pull request comment, edited in place on every push. Woodpecker hides secrets from pull requests until you allow the pull_request event on each one.

when:
  - event: pull_request

steps:
  - name: depdelta
    image: ghcr.io/mbobiosio/depdelta-cli:latest
    commands:
      - depdelta
    environment:
      DEPDELTA_API_KEY:
        from_secret: depdelta_api_key
      FORGEJO_TOKEN:
        from_secret: forgejo_token
    failure: ignore

DEPDELTA_API_KEY

Your API key, from Settings, as the secret depdelta_api_key.

FORGEJO_TOKEN

An access token with the write:issue and read:repository scopes (a bot account works best), as the secret forgejo_token.

Bitbucket Cloud, in pull request pipelines. The review is one pull request comment, edited in place on every push. To fail the build with --fail-on, drop the || true.

pipelines:
  pull-requests:
    "**":
      - step:
          name: DepDelta
          image: ghcr.io/mbobiosio/depdelta-cli:latest
          clone:
            depth: full
          script:
            # A DepDelta outage shouldn't fail the pull request.
            - depdelta || true

DEPDELTA_API_KEY

Your API key, from Settings, as a secured repository variable.

BITBUCKET_ACCESS_TOKEN

A repository access token with the pullrequest:write scope. Or an Atlassian API token, as BITBUCKET_EMAIL and BITBUCKET_API_TOKEN.

Azure Repos pull requests, run as build validation on the target branch. The review is one pull request thread, edited in place on every build. Let the build service comment: in the repository's security, allow Contribute to pull requests for the project's Build Service.

trigger: none

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self
    fetchDepth: 0
  - script: pipx run --spec depdelta-cli depdelta
    displayName: DepDelta
    # A DepDelta outage shouldn't fail the pull request.
    continueOnError: true
    env:
      DEPDELTA_API_KEY: $(DEPDELTA_API_KEY)
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

DEPDELTA_API_KEY

Your API key, from Settings, as a secret pipeline variable.

SYSTEM_ACCESSTOKEN

The build's own token, mapped in as above. Or a personal access token with Code: Read & write, as AZURE_DEVOPS_TOKEN.