Skip to content

Commit

Permalink
chore(deps): Included dependency review
Browse files Browse the repository at this point in the history
> Dependency Review GitHub Action in your repository to enforce dependency reviews on your pull
requests.
> The action scans for vulnerable versions of dependencies introduced by package version changes
in pull requests,
> and warns you about the associated security vulnerabilities.
> This gives you better visibility of what's changing in a pull request,
> and helps prevent vulnerabilities being added to your repository.

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
  • Loading branch information
naveensrinivasan committed May 19, 2022
1 parent 952105e commit 4a7840e
Showing 1 changed file with 22 additions and 0 deletions.
22 changes: 22 additions & 0 deletions .github/workflows/dependency-review.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Dependency Review Action
#
# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing
# known-vulnerable versions of the packages declared or updated in the PR. Once installed,
# if the workflow run is marked as required, PRs introducing known-vulnerable
# packages will be blocked from merging.
#
# Source repository: https://github.com/actions/dependency-review-action
name: 'Dependency Review'
on: [pull_request]

permissions:
contents: read

jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- name: 'Checkout Repository'
uses: actions/checkout@v3
- name: 'Dependency Review'
uses: actions/dependency-review-action@v1

0 comments on commit 4a7840e

Please sign in to comment.