security-dependency-review.yml•1.11 kB
name: "Security: Dependency Review"
on:
pull_request:
types: [opened, synchronize, reopened, edited]
permissions:
contents: read
jobs:
dependency-review:
name: "PR Changes"
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
egress-policy: audit
- name: Checkout Repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- name: Dependency Review
uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
with:
# Scan for vulnerabilities and reject PR if severity threshold exceeded
fail-on-severity: critical
# Deny licenses that are problematic for open source projects
deny-licenses: "AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later"
# Additional reviewers for dependency-related changes
comment-summary-in-pr: true