Skip to content

Commit 6ef9363

Browse files
ZahnentfernerZahnentferner
authored
Merge pull request #105 from kpj2006/patch-4
Add dependency review workflow to scan for license violations and CVEs
2 parents b586b0c + fea2017 commit 6ef9363

File tree

1 file changed

+153
-0
lines changed

1 file changed

+153
-0
lines changed

‎.github/workflows/dependency-review-action.yml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# Automatically scans every PR for newly added dependencies
2+
# Blocks merges if a dependency license is NOT in the allow-list
3+
# Flags CVEs with moderate+ severity
4+
# Docs: https://github.com/actions/dependency-review-action
5+
6+
7+
name: Dependency Review
8+
9+
on:
10+
pull_request:
11+
branches:
12+
- main
13+
- master
14+
- develop
15+
# Only re-run when dependency manifests actually change
16+
paths:
17+
# JavaScript / TypeScript / Node
18+
- "**/package.json"
19+
- "**/package-lock.json"
20+
- "**/yarn.lock"
21+
- "**/pnpm-lock.yaml"
22+
# Python
23+
- "**/requirements*.txt"
24+
- "**/Pipfile.lock"
25+
- "**/pyproject.toml"
26+
- "**/poetry.lock"
27+
# Rust
28+
- "**/Cargo.toml"
29+
- "**/Cargo.lock"
30+
# Go
31+
- "**/go.mod"
32+
- "**/go.sum"
33+
# Java / Kotlin / Android
34+
- "**/pom.xml"
35+
- "**/build.gradle"
36+
- "**/build.gradle.kts"
37+
- "**/*.gradle"
38+
# Ruby
39+
- "**/Gemfile.lock"
40+
# Docker / Infrastructure
41+
- "**/Dockerfile"
42+
- "**/docker-compose*.yml"
43+
- "**/docker-compose*.yaml"
44+
# GitHub Actions themselves
45+
- ".github/workflows/*.yml"
46+
- ".github/workflows/*.yaml"
47+
48+
permissions:
49+
contents: read # Required to read the repo content
50+
# pull-requests: write # Required to post review comments on the PR
51+
52+
jobs:
53+
dependency-review:
54+
name: Dependency & License Review
55+
runs-on: ubuntu-latest
56+
57+
steps:
58+
- name: Run Dependency Review
59+
uses: actions/dependency-review-action@v4
60+
with:
61+
# ── VULNERABILITY SETTINGS ──────────────────────────
62+
# Fail if any newly added dependency has a CVE at this
63+
# severity level or above. Options: low | moderate | high | critical
64+
fail-on-severity: moderate
65+
66+
# Which dependency scopes to check for vulnerabilities
67+
# Options: runtime | development | unknown (comma-separated)
68+
fail-on-scopes: runtime
69+
70+
# ── LICENSE ENFORCEMENT ─────────────────────────────
71+
# ALLOW: Only these licenses are permitted in new dependencies.
72+
# PRs introducing any other license will fail automatically.
73+
# Full SPDX list: https://spdx.org/licenses/
74+
allow-licenses: >-
75+
MIT,
76+
Apache-2.0,
77+
BSD-2-Clause,
78+
BSD-3-Clause,
79+
ISC,
80+
CC0-1.0,
81+
Unlicense,
82+
GPL-2.0-only,
83+
GPL-2.0-or-later,
84+
GPL-3.0-only,
85+
GPL-3.0-or-later,
86+
LGPL-2.0-only,
87+
LGPL-2.0-or-later,
88+
LGPL-2.1-only,
89+
LGPL-2.1-or-later,
90+
LGPL-3.0-only,
91+
LGPL-3.0-or-later,
92+
AGPL-3.0-only,
93+
AGPL-3.0-or-later,
94+
MPL-2.0,
95+
EUPL-1.2,
96+
Python-2.0,
97+
PSF-2.0
98+
99+
# PER-PACKAGE EXCEPTIONS: Packages excluded from license checks entirely.
100+
# Use for packages with unrecognized/non-standard license declarations.
101+
# Format: "pkg:npm/name, pkg:pypi/name, pkg:githubactions/owner/repo@version"
102+
# ── Edit this list when adding approved exceptions ──
103+
# allow-dependencies-licenses: >-
104+
# pkg:npm/example-package,
105+
# pkg:pypi/example-package
106+
107+
# ── SCOPE FILTERING ─────────────────────────────────
108+
# Skip dev-only dependencies (test frameworks, linters, etc.)
109+
# They are not shipped to production so risk is lower.
110+
# Set to "all" to also scan devDependencies.
111+
# Options: runtime | development | all
112+
# Using "runtime" keeps noise low in template repos
113+
# where dev deps vary wildly by project type.
114+
# Uncomment the line below to enforce on devDeps too:
115+
# fail-on-scopes: runtime, development
116+
allow-ghsas: "" # Leave empty to block all known GHSAs
117+
118+
# ── OUTPUT & COMMENTS ────────────────────────────────
119+
# Post a detailed summary comment directly on the PR
120+
# comment-summary-in-pr: always
121+
122+
# Fail (don't just warn) on license violations.
123+
# Change to "true" to only warn without failing.
124+
warn-only: false
125+
126+
# ── VULNERABILITY DATABASE ───────────────────────────
127+
# Use the GitHub Advisory Database (GHSA) as the source.
128+
# This is the default; listed explicitly for clarity.
129+
# vulnerability-check: true # default
130+
# Add explicitly so teams know it's active
131+
show-openssf-scorecard: true
132+
warn-on-openssf-scorecard-level: 3
133+
134+
# Post a status summary badge to PR
135+
# summarize:
136+
# name: Post Review Summary
137+
# runs-on: ubuntu-latest
138+
# needs: dependency-review
139+
# if: always()
140+
141+
# steps:
142+
# - name: 📋 Summarize Result
143+
# run: |
144+
# if [ "${{ needs.dependency-review.result }}" == "success" ]; then
145+
# echo "✅ Dependency review passed — no license violations or CVEs found."
146+
# else
147+
# echo "❌ Dependency review failed — check the PR comment for details."
148+
# echo ""
149+
# echo "Common fixes:"
150+
# echo " • Replace dependencies using licenses not in allow-licenses"
151+
# echo " • Upgrade vulnerable packages to patched versions"
152+
# echo " • Add an explicit exception to allow-dependencies-licenses if intentional"
153+
# fi

0 commit comments

Comments
 (0)