actions/dependency-review-action "only runs on pull_request events"

By Daniel Zoghalchali·Latchkey

dependency-review-action diffs the dependency manifest between base and head of a PR. On push or schedule there is no PR diff, so it errors out.

What this error means

The dependency-review step fails with "can only be run on pull_request or pull_request_target events".

Error: Dependency review is not supported on this event type.
This action can only be run on pull_request or pull_request_target events.

Common causes

Wrong trigger

The workflow runs on push, schedule, or workflow_dispatch instead of pull_request.

Reused job across triggers

A job shared by multiple events includes dependency-review, which only the PR trigger supports.

How to fix it

Scope the workflow/job to pull_request

1. Set on: pull_request (or pull_request_target) for the workflow.
2. Or gate the step with if: github.event_name == pull_request.
3. Re-run from a pull request.

on:
  pull_request:
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4

How to prevent it

• Put PR-only actions in PR-only workflows.
• Guard event-specific steps with if: on github.event_name.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions