| name: Dependency Review | |
| on: | |
| pull_request: | |
| branches: [ trunk ] | |
| permissions: | |
| contents: read # for actions/checkout to fetch code | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v5 | |
| # TODO: We really want one check for direct prod dependencies where we | |
| # only allows ASF, MIT, BSD and nother one for testing / dev | |
| # dependencies where we also allow GPL, etc. | |
| #with: | |
| # allow-licenses: MIT, Apache-2.0, BSD-3-Clause |