mirror of https://github.com/garrytan/gstack.git
20 lines
619 B
YAML
20 lines
619 B
YAML
name: Dependency Review
|
|
# Blocks pull requests that introduce dependencies with known vulnerabilities.
|
|
# Uses GitHub's Dependency Graph to diff base...head, so it only runs on PRs.
|
|
on: [pull_request]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
dependency-review:
|
|
runs-on: ubicloud-standard-8
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@v4
|
|
with:
|
|
# Fail the check when a PR adds a dependency with a high or critical
|
|
# advisory. Lower the threshold to `moderate`/`low` to tighten.
|
|
fail-on-severity: high
|