mirror of
https://github.com/LearningCircuit/local-deep-research.git
synced 2026-06-15 19:46:56 +03:00
ebbd48d64e
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](de0fac2e45...df4cb1c069)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
77 lines
2.3 KiB
YAML
77 lines
2.3 KiB
YAML
name: Dependency Review
|
|
|
|
on:
|
|
# NOTE: dependency-review requires PR context to compare changes.
|
|
# It remains on PRs only and is NOT included in release gate.
|
|
# The osv-scanner and npm-audit in release gate cover dependency vulnerabilities.
|
|
pull_request:
|
|
branches: [main, dev, develop]
|
|
paths:
|
|
- 'pyproject.toml'
|
|
- 'pdm.lock'
|
|
- 'requirements*.txt'
|
|
- 'package.json'
|
|
- 'package-lock.json'
|
|
- 'tests/ui_tests/package.json'
|
|
- 'tests/ui_tests/package-lock.json'
|
|
workflow_dispatch:
|
|
|
|
permissions: {} # Minimal top-level for OSSF Scorecard Token-Permissions
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
dependency-review:
|
|
name: Dependency Review
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
|
|
with:
|
|
# Fail on high and critical severity vulnerabilities
|
|
fail-on-severity: high
|
|
# Allow only known permissive + weak-copyleft licenses (ASF Category A + B)
|
|
# All licenses below are commercially usable
|
|
# LGPL is excluded per ASF Category X policy
|
|
allow-licenses: >-
|
|
MIT,
|
|
Apache-2.0,
|
|
BSD-2-Clause,
|
|
BSD-3-Clause,
|
|
ISC,
|
|
MPL-2.0,
|
|
Unlicense,
|
|
CC0-1.0,
|
|
CC-BY-3.0,
|
|
CC-BY-4.0,
|
|
Python-2.0,
|
|
PSF-2.0,
|
|
0BSD,
|
|
OFL-1.1,
|
|
Zlib,
|
|
BlueOak-1.0.0
|
|
# Allow specific packages with complex license expressions
|
|
# dompurify is dual-licensed (Apache-2.0 OR MPL-2.0) but npm reports complex SPDX
|
|
allow-dependencies-licenses: >-
|
|
pkg:npm/dompurify
|
|
# Comment on PR with review summary
|
|
comment-summary-in-pr: on-failure
|