dependency-review.yml

Enable keyboard shortcuts

# Dependency Review Action

# This Action will scan dependency manifest files that change as part of a Pull Request,

# surfacing known-vulnerable versions of the packages declared or updated in the PR.

# Once installed, if the workflow run is marked as required,

# PRs introducing known-vulnerable packages will be blocked from merging.

# Source repository: https://github.com/actions/dependency-review-action

name: "Dependency Review"

on:

  pull_request:

  merge_group:

concurrency:

  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

  cancel-in-progress: true

permissions:

  contents: read

jobs:

  dependency-review:

    uses: mozilla/actions/.github/workflows/dependency-review.yml@2e46408d5c495e59a21e5e125e82008fad0d9408 # v1.1.7