Bump the dotnet-dependencies group with 10 updates #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency review | |
| # On every pull request, fail if the change introduces a dependency with a known | |
| # high-or-critical CVE (GitHub Advisory Database). This is the merge-time gate | |
| # that complements Dependabot's continuous alerts and the SBOM workflow, giving | |
| # the B8 "dependency/CVE scanning" supply-chain requirement a green-gate. | |
| on: | |
| pull_request: | |
| branches: [ master ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-review: | |
| name: Dependency review | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Review dependencies | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| comment-summary-in-pr: on-failure |