dependency-review.yml

name: Dependency Review

on:
  pull_request:

permissions:
  contents: read

concurrency:
  group: dependency-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Review dependency changes
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          # Tauri 2's Linux GTK3/WebKitGTK stack still pins glib 0.18.x.
          # GHSA-wrw7-89jp-8q8g affects VariantStrIter, which is not called by
          # this shell or its locked dependency sources. Remove this exact
          # exception when Tauri moves its Linux runtime to glib >= 0.20.
          allow-ghsas: GHSA-wrw7-89jp-8q8g