dependency-review.yml

Enable keyboard shortcuts

# Dependency Review Action

# This Action will scan dependency manifest files that change as part of a Pull Request,

# surfacing known-vulnerable versions of the packages declared or updated in the PR.

# Once installed, if the workflow run is marked as required,

# PRs introducing known-vulnerable packages will be blocked from merging.

# Source repository: https://github.com/actions/dependency-review-action

name: 'Dependency Review'

on:

  pull_request:

    branches: ["main"]

  merge_group:

concurrency:

  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

  cancel-in-progress: true

permissions:

  contents: read

jobs:

  dependency-review:

    name: Dependency review

    runs-on: ubuntu-24.04

    steps:

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

        with:

          persist-credentials: false

      - uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

        with:

          base-ref: ${{ github.event.pull_request.base.sha || 'main' }}

          head-ref: ${{ github.event.pull_request.head.sha || github.ref }}