|
# Dependency Review Action |
|
# |
|
# This Action will scan dependency manifest files that change as part of a Pull Request, |
|
# surfacing known-vulnerable versions of the packages declared or updated in the PR. |
|
# Once installed, if the workflow run is marked as required, |
|
# PRs introducing known-vulnerable packages will be blocked from merging. |
|
# |
|
# Source repository: https://github.com/actions/dependency-review-action |
|
name: 'Dependency Review' |
|
on: [pull_request] |
|
|
|
permissions: |
|
contents: read |
|
|
|
jobs: |
|
dependency-review: |
|
runs-on: ubuntu-latest |
|
steps: |
|
- name: 'Checkout Repository' |
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.3.0 |
|
- name: 'Dependency Review' |
|
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 |