pipelock-verify-python/.github/workflows/dependency-review.yml at main · luckyPipewrench/pipelock-verify-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
name: Dependency Review

on:
  pull_request:
    branches: [main]

permissions:
  contents: read
  pull-requests: write

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Dependency Review
        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
        with:
          fail-on-severity: high
          # Gate runtime, development, and unknown-scope deps. Without this
          # the action defaults to runtime-only, which would miss
          # additions under pyproject.toml [project.optional-dependencies]
          # (dev/release groups).
          fail-on-scopes: runtime, development, unknown
          deny-licenses: >-
            AGPL-3.0-only,
            AGPL-3.0-or-later,
            GPL-2.0-only,
            GPL-2.0-or-later,
            GPL-3.0-only,
            GPL-3.0-or-later
          comment-summary-in-pr: on-failure