From 6126b2bb6666b419c7d2f0b92f3955ac253262e9 Mon Sep 17 00:00:00 2001 From: Jayesh Betala Date: Thu, 18 Jun 2026 14:40:58 +0530 Subject: [PATCH] ci: add Dependency Review Action to block vulnerable dependency changes gstack ships dependency-bearing manifests (package.json, bun.lock) but has no pull-request gate that blocks newly introduced known-vulnerable dependencies. A PR can currently add or bump an npm/Bun dependency with no CI check against advisories. Add a Dependency Review workflow using GitHub's official actions/dependency-review-action, which diffs the dependency graph (base...head) on each pull request and fails when a change introduces a dependency with a high or critical advisory. The threshold is documented inline and easy to tighten to moderate/low. Matches existing workflow house style (ubicloud-standard-8 runner, version- tagged actions, minimal contents:read permissions). Validated with actionlint 1.7.12 (the same linter run by .github/workflows/actionlint.yml): no issues. Fixes #1987 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/dependency-review.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 000000000..9827a5bba --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,19 @@ +name: Dependency Review +# Blocks pull requests that introduce dependencies with known vulnerabilities. +# Uses GitHub's Dependency Graph to diff base...head, so it only runs on PRs. +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubicloud-standard-8 + steps: + - uses: actions/checkout@v4 + - name: Dependency Review + uses: actions/dependency-review-action@v4 + with: + # Fail the check when a PR adds a dependency with a high or critical + # advisory. Lower the threshold to `moderate`/`low` to tighten. + fail-on-severity: high