.github/workflows/dep.yml

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

name: Dependency

on:
  pull_request:
    branches:
      - master
      - branch-*
    paths:
      # when pom or dependency workflow changes
      - '**/pom.xml'
      - '.github/workflows/dep.yml'
      - 'build/dependency.sh'
      - 'dev/dependencyList'

concurrency:
  group: dep-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  dep:
    name: Dependency check
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
      - name: setup java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 8
          cache: 'maven'
      - name: Setup Maven
        uses: ./.github/actions/setup-maven
      - name: Check dependency list
        run: build/dependency.sh
      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: moderate