From df0e0b0a158b1b0f8c8b0239229a7c9d75679d07 Mon Sep 17 00:00:00 2001 From: ildyria Date: Wed, 17 Jun 2026 08:06:56 +0200 Subject: [PATCH] Add dependency review --- .github/workflows/dependency-review.yml | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..fe7ad9d --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,32 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + with: + egress-policy: audit + + - name: 'Checkout Repository' + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - name: 'Dependency Review' + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + # with: + # # No fix available yet + # # Note that the model is directly baked into the inage + # # So the risk is limited. + # allow-ghsas: GHSA-hqmj-h5c6-369m