From 5da2a824575f2dc0794dca9f0b644bcd01fd65c7 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Sun, 11 Oct 2026 10:48:28 -0500 Subject: [PATCH 1/2] ci: review dependency vulnerabilities on pull requests --- .github/workflows/dependency-review.yml | 26 +++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..32c3f03 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,26 @@ +name: Dependency review + +on: + pull_request: + branches: + - main + +permissions: + contents: read + +jobs: + dependency-review: + name: Dependency review + runs-on: ubuntu-24.04 + timeout-minutes: 10 + steps: + - name: Review dependency changes + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + fail-on-severity: high + fail-on-scopes: runtime,development,unknown + warn-only: false + comment-summary-in-pr: never + show-openssf-scorecard: false + retry-on-snapshot-warnings: true + retry-on-snapshot-warnings-timeout: 120 From ddd0cd1bc9fc5e37e0e131818b4bd76942331cc7 Mon Sep 17 00:00:00 2001 From: Zoey Rose Date: Sun, 11 Oct 2026 11:47:13 -0500 Subject: [PATCH 2/2] ci: handle dependency review lifecycle and review findings --- .github/workflows/dependency-review.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 32c3f03..9a4ad03 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -2,8 +2,11 @@ name: Dependency review on: pull_request: + types: [opened, synchronize, reopened, edited] branches: - main + merge_group: + types: [checks_requested] permissions: contents: read