v1.4.0

Added

• audit --fix (CLI): writes the missing dependency folders into each workflow's on.<event>.paths list and turns bare directories into dir/**, editing only those lists. Each edit is checked by re-parsing the workflow; anything it can't change safely is reported and left alone.

v1.3.2

Fixed

• Node: without a workspace declaration, only workspace:/file:/link:/portal: dependencies link local packages (plain version ranges come from the registry).
• Maven: a dependency pinned to a different version than the local module is treated as the published artifact, not a local edge.
• Audit: only filters that watch a whole project folder (dir, dir/, dir/**) make a workflow "about" that project; file-scoped filters are treated as deliberately narrow.

v1.3.1

Fixed: packages outside the npm/Yarn/pnpm workspace globs (for example examples/* that install published versions) are no longer linked to local packages by name.

v1.3.0: Python dependency edges

Added

• Python: dependency edges from local path dependencies ([tool.uv.sources], Poetry path =, @ file: requirements).

Fixed

• Path-filter audit: wildcard roots (crates/*/src/**) and filters rooted inside a package count as watching it.

v1.2.2

Fixed: the path-filter audit treats wildcard roots such as crates/*/src/** as watching each matching crate.

v1.2.1

Fixed: the path-filter audit no longer reports a dependency as missing when a filter is rooted inside its folder (for example pkg/src/**).

v1.2.0: path-filter audit

Added

• audit input (off / warn / fail) and audit CLI command: checks every workflow's on.*.paths list against the dependency graph and reports missing dependency folders, directories without /**, and references to deleted workflow files, as annotations and in the job summary. New output: audit_findings.

Fixed

• projects CLI command no longer fails on dependency cycles that come from manifests.

v1.1.0: Go packages, Maven and Gradle dependency edges

Added

• Go: a module that builds several binaries (cmd/*) is split into one project per package, linked by its own imports. A change to internal/foo selects only the binaries that import it.
• Maven: modules depend on their parent pom and on sibling artifacts. Aggregator poms (packaging pom) build nothing.
• Gradle: project(':a:b') references create dependency edges.
• Docs: a recipe for calling an existing reusable workflow once per affected project, and a guide for migrating from on.paths filters.

Fixed

• Go external test packages (package foo_test) no longer create false dependency cycles.

v1.0.1: zero-config monorepo CI

Same code as v1.0.0. This release publishes the action to the GitHub Marketplace.

Build, test and deploy only the projects a change affects, with no config file needed.

dynamic-monorepo works from three things:

• the git diff
• the projects in your repository, found from package.json, go.mod, Cargo.toml, Dockerfile, pyproject.toml, pom.xml, Gradle, .csproj and Helm Chart.yaml
• the dependencies between those projects, read from their manifests

From these it outputs JSON lists for strategy.matrix, and the job summary says why each project was picked.

- uses: actions/checkout@v4
- uses: Continuous-Actions/dynamic-monorepo@v1
  id: plan
# needs.plan.outputs.build  -> ["@acme/shared","@acme/api","@acme/web"]

Highlights

• Zero config. It auto-detects Node, Go, Rust, Python, Java (Maven/Gradle), .NET, Docker and Helm projects. A dynamic-monorepo.config.json (with a JSON Schema) is only needed to override what was detected.
• Follows dependencies. A change to a shared library selects everything that depends on it. Lockfiles only select the projects of their own ecosystem.
• Matrix outputs: build, test, deploy and docker lists, plus paths and dockerfiles maps, has_* flags, and *_batches outputs for lists longer than 256 jobs.
• Explains itself. The job summary gives a reason for every project, and the CLI previews the plan locally: npx github:Continuous-Actions/dynamic-monorepo --base origin/main.
• Works with the default checkout. A shallow clone is enough: it fetches only the commits it needs. It handles pull requests, pushes, force pushes, merge queues and new branches. When it can't compare correctly, it selects everything and says why.
• Safe to adopt:
  • It needs only contents: read, uses no secrets and makes no API calls.
  • Nothing from your repository is executed.
  • It ships as a single committed bundle of about 100 KB.
  • Releases are immutable.
  • The code went through adversarial security and correctness reviews.

Demo: https://github.com/Continuous-Actions/dynamic-monorepo-demo

v1.0.0: zero-config monorepo CI

Build, test and deploy only the projects a change affects, with no config file needed.

dynamic-monorepo works from three things:

• the git diff
• the projects in your repository, found from package.json, go.mod, Cargo.toml, Dockerfile, pyproject.toml, pom.xml, Gradle, .csproj and Helm Chart.yaml
• the dependencies between those projects, read from their manifests

From these it outputs JSON lists for strategy.matrix, and the job summary says why each project was picked.

- uses: actions/checkout@v4
- uses: Continuous-Actions/dynamic-monorepo@v1
  id: plan
# needs.plan.outputs.build  -> ["@acme/shared","@acme/api","@acme/web"]

Highlights

• Zero config. It auto-detects Node, Go, Rust, Python, Java (Maven/Gradle), .NET, Docker and Helm projects. A dynamic-monorepo.config.json (with a JSON Schema) is only needed to override what was detected.
• Follows dependencies. A change to a shared library selects everything that depends on it. Lockfiles only select the projects of their own ecosystem.
• Matrix outputs: build, test, deploy and docker lists, plus paths and dockerfiles maps, has_* flags, and *_batches outputs for lists longer than 256 jobs.
• Explains itself. The job summary gives a reason for every project, and the CLI previews the plan locally: npx github:Continuous-Actions/dynamic-monorepo --base origin/main.
• Works with the default checkout. A shallow clone is enough: it fetches only the commits it needs. It handles pull requests, pushes, force pushes, merge queues and new branches. When it can't compare correctly, it selects everything and says why.
• Safe to adopt:
  • It needs only contents: read, uses no secrets and makes no API calls.
  • Nothing from your repository is executed.
  • It ships as a single committed bundle of about 100 KB.
  • Releases are immutable.
  • The code went through adversarial security and correctness reviews.

Demo: https://github.com/Continuous-Actions/dynamic-monorepo-demo