ForexRadar/.github/workflows/dependency-review.yml at a9a25673d1c46fad097edf195f3d794b503edfe7 · avishj/ForexRadar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
name: Dependency Review

on:
  pull_request:
    branches: [main]

permissions: {}

jobs:
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    timeout-minutes: 5

    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Dependency Review
        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
        with:
          fail-on-severity: low
          vulnerability-check: true
          license-check: true
          fail-on-scopes: runtime, development, unknown
          comment-summary-in-pr: always
          retry-on-snapshot-warnings: true
          retry-on-snapshot-warnings-timeout: 120
          warn-only: false
          show-openssf-scorecard: true
          warn-on-openssf-scorecard-level: 3
          allow-licenses: >-
            MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD,
            CC0-1.0, CC-BY-3.0, CC-BY-4.0, Unlicense, Python-2.0,
            BlueOak-1.0.0, Artistic-2.0, Zlib, MPL-2.0