diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review-vulnerability-license.yml similarity index 81% rename from .github/workflows/dependency-review.yml rename to .github/workflows/dependency-review-vulnerability-license.yml index 6b6d49b..4feb9c4 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review-vulnerability-license.yml @@ -1,4 +1,4 @@ -name: Dependency Review +name: Dependency Review - License/Vulns ### # This workflow analyzes dependencies introduced by pull requests to help identify security vulnerabilities @@ -8,9 +8,9 @@ name: Dependency Review # The default preset is "license-deny-vulnerability-high". This preset has this behavior: # # Fail if a dependency is found with a license that is in the deny_licenses list and fails if vulnerabilities are found in the -# dependency tree with specified severity or greater. +# dependency tree with a high severity or greater. # -# To set the DEPENDENCY_REVIEW_CONFIG_PRESET repo variable using the gh cli, see: +# To override the config preset, set the DEPENDENCY_REVIEW_CONFIG_PRESET repo variable using the gh cli: # gh variable set DEPENDENCY_REVIEW_CONFIG_PRESET --body "license-deny-vulnerability-high" ### @@ -21,8 +21,8 @@ on: permissions: {} jobs: - dependency-review: - name: Review Dependencies + license-and-vulnerabilities: + name: License and Vulnerabilities permissions: contents: read runs-on: ubuntu-latest diff --git a/.github/workflows/dependency-review-vulnerability.yml b/.github/workflows/dependency-review-vulnerability.yml new file mode 100644 index 0000000..2bf7c3b --- /dev/null +++ b/.github/workflows/dependency-review-vulnerability.yml @@ -0,0 +1,35 @@ +name: Dependency Review - Vulnerability + +### +# This workflow analyzes dependencies introduced by pull requests to help identify security vulnerabilities. +# +# To override the default configuration preset, set the `DEPENDENCY_REVIEW_CONFIG_PRESET` variable in the repository settings. +# The default preset is "vulnerability-high". This preset has this behavior: +# +# Fail if a dependency is found in the dependency tree with a high severity or greater. +### + +on: + merge_group: + pull_request: + +permissions: {} + +jobs: + vulnerability: + name: Vulnerabilities + permissions: + contents: read + runs-on: ubuntu-latest + # Skip on merge group events + if: ${{ github.event_name == 'pull_request' }} + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Dependency Review + uses: smartcontractkit/.github/actions/dependency-review@dependency-review/v2 + with: + config-preset: vulnerability-high