laminasviewrenderer-vite-url/.github/workflows/dependency-review.yml at master · mimmi20/laminasviewrenderer-vite-url · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
# Dependency Review Action
#
# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
#
# Source repository: https://github.com/actions/dependency-review-action
# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement

# https://help.github.com/en/categories/automating-your-workflow-with-github-actions

# file-version: 1.0

name: "Dependency Review"

on:
  - pull_request

permissions:
  contents: read
  pull-requests: write

jobs:
  dependency-review:
    name: "Review"
    uses: "mimmi20/ci/.github/workflows/review-dependency.yml@8.3"

  # This is a meta job to avoid to have to constantly change the protection rules
  # whenever we touch the matrix.
  review-status:
    name: "Review Status"

    runs-on: "ubuntu-latest"

    if: always()

    needs:
      - "dependency-review"

    steps:
      - name: Failing run
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled') }}
        run: exit 1

      - name: Successful run
        if: ${{ !(contains(needs.*.result, 'failure')) && !(contains(needs.*.result, 'skipped')) && !(contains(needs.*.result, 'cancelled')) }}
        run: exit 0