blob: 8701cfa9ca4b163b8d14b3b00feeab3721a252d1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
name: Dependency Review
# Looks at the dependencies a pull request adds or changes, and fails when
# one of them has a known vulnerability of high severity or worse.
# Dependabot alerts report what is already there; this holds what comes in.
on:
pull_request:
permissions: {}
concurrency:
group: dependency-review-${{ github.ref }}
cancel-in-progress: true
jobs:
review:
name: Dependency review
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Review the dependency changes
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
with:
fail-on-severity: high
|