dependassign

A GitHub composite action that automatically requests a review from a random team member on open, unreviewed Dependabot pull requests.

Install it in any repo by dropping a single workflow file in .github/workflows/. The action itself lives here centrally — no code is distributed to calling repos.

How it works

On a configurable cron schedule (or manual trigger), the action:

1. Finds open PRs authored by dependabot[bot] with no requested reviewers
2. Skips any PR labeled skip-dependassign
3. Checks the repo for a per-repo override (.github/dependassign.yml)
4. Picks a random member of the configured GitHub team and requests their review

Runs are idempotent — PRs that already have a reviewer are left untouched. If a reviewer is later dismissed or removed, the next scheduled run will assign a new one.

Setup

1. GitHub App

Create a GitHub App in your GitHub organization (Settings → Developer settings → GitHub Apps → New GitHub App):

Setting	Value
Webhook	Disabled
Repository permissions → Contents	Read-only
Repository permissions → Pull requests	Read & write
Organization permissions → Members	Read-only

After creating the app:

• Note the App ID on the app settings page
• Generate a private key (scroll to Private keys → Generate a private key)
• Install the app on the org and note the Installation ID from the URL (/settings/installations/{ID})

2. Org-level secrets

Add three secrets at Settings → Secrets and variables → Actions for your organization, accessible to all repos that will call this action:

Secret	Value
DEPENDASSIGN_APP_ID	Numeric App ID
DEPENDASSIGN_APP_INSTALLATION_ID	Numeric installation ID
DEPENDASSIGN_APP_PRIVATE_KEY	Base64-encoded private key: base64 -w 0 app.pem

3. Caller workflow

Copy the following into .github/workflows/dependassign.yml in each repo you want to manage:

name: Dependabot PR Auto-Assign

on:
  schedule:
    - cron: "0 14 * * 1-5" # weekdays 2pm UTC
  workflow_dispatch: {}

jobs:
  assign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: KamiHQ/dependassign@main
        with:
          app-id: ${{ secrets.DEPENDASSIGN_APP_ID }}
          app-installation-id: ${{ secrets.DEPENDASSIGN_APP_INSTALLATION_ID }}
          app-private-key: ${{ secrets.DEPENDASSIGN_APP_PRIVATE_KEY }}

A ready-to-copy version is at .github/workflows/dependassign.yml.

Action inputs

Input	Required	Default	Description
app-id	yes	—	GitHub App numeric ID
app-installation-id	yes	—	GitHub App installation ID for the org
app-private-key	yes	—	Base64-encoded RSA private key
team-slug	no	developers	Team whose members are eligible reviewers
exclude-label	no	skip-dependassign	PRs with this label are skipped
exclude-reviewers	no	-	Exclude specific reviewers by Github ID

Per-repo override

To use a different reviewer pool for a specific repo, add .github/dependassign.yml to that repo. Use one of:

# Swap the reviewer team
team: "team-frontend"

# Use an explicit list of GitHub usernames
reviewers:
  - alice
  - bob

If the file is absent or empty, the global team-slug input is used.

Skipping a PR

Add the label skip-dependassign (or the value of exclude-label) to any PR to prevent it from being assigned.

Development

go test ./...   # run unit tests
go build ./...  # verify compilation

The Go tool is invoked directly by the composite action via go run . — no build step is needed for deployment.