# deps-check

> deps check

Fail if the deploy lock (requirements.txt) has drifted from uv.lock on any first-party (editable-sourced) dependency -- the footgun where a sibling version bump reaches uv.lock but not the committed requirements.txt, so the deployed image installs stale first-party code against newer generated code. Offline: a pure text compare of the two committed files (no index, no CodeArtifact, no sibling checkouts), so it runs in the sibling-less app CI. Runs `just deps check-deps-ci`; run actions/checkout + the just-vendor action (to vendor the deps module) first.

## Inputs

| Input | Required | Default | Description |
|---|---|---|---|
| `working-directory` | no | `.` | Directory holding uv.lock + requirements.txt + the vendored deps module. |

## Usage

```yaml
- uses: actions/checkout@v6
- uses: FSHTech/github-actions/deps-check@v1
```