From 910bd2b04644121e783cb2c94a6954f63ac60dda Mon Sep 17 00:00:00 2001 From: Alexander Sullivan Date: Sun, 18 Oct 2026 19:44:31 -0400 Subject: [PATCH 1/5] dependency-review-action --- .github/workflows/dependency-review.yaml | 30 ++++++++++++++++++++++++ docs/usage/testing.md | 17 ++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 .github/workflows/dependency-review.yaml diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml new file mode 100644 index 00000000..bf0b079c --- /dev/null +++ b/.github/workflows/dependency-review.yaml @@ -0,0 +1,30 @@ +name: Dependency Review + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +jobs: + dependency-review: + name: Dependency Review + runs-on: ubuntu-latest + timeout-minutes: 5 + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + - name: Review dependency changes + uses: actions/dependency-review-action@v5 + with: + license-check: true + vulnerability-check: true + fail-on-severity: high + fail-on-scopes: runtime, development, unknown + allow-licenses: >- + 0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, BlueOak-1.0.0, + CC0-1.0, ISC, MIT, MIT-0, Python-2.0, PSF-2.0, Unlicense + retry-on-snapshot-warnings: true + retry-on-snapshot-warnings-timeout: 120 diff --git a/docs/usage/testing.md b/docs/usage/testing.md index 1178fca8..8baf46e5 100644 --- a/docs/usage/testing.md +++ b/docs/usage/testing.md @@ -147,6 +147,23 @@ Markdown is linted by a separate [markdown-lint.yaml](../../.github/workflows/ma No workflow calls `npm run validate`, and none of the steps above writes to a checked-out file. A violation that `npm run validate` would have repaired locally therefore fails CI instead, which is why the local run belongs before the commit rather than after the push. +### Dependency review + +The [dependency-review.yaml](../../.github/workflows/dependency-review.yaml) workflow runs the [dependency review action](https://github.com/actions/dependency-review-action/blob/v5.0.0/README.md) on every pull request to `main`, without a path filter. It compares dependency changes between the pull request's base and head revisions using GitHub's dependency graph, which records detected packages and their relationships. The action is available for public repositories on GitHub Free, including repositories owned by personal accounts. It does not require the separate [enterprise licence compliance feature](https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/supply-chain-security/open-source-license-compliance). + +The workflow sets these policy inputs: + +- **`allow-licenses`**: Accepts `0BSD`, `Apache-2.0`, `BSD-2-Clause`, `BSD-3-Clause`, `BlueOak-1.0.0`, `CC0-1.0`, `ISC`, `MIT`, `MIT-0`, `Python-2.0`, `PSF-2.0`, and `Unlicense`. These are Software Package Data Exchange (SPDX) identifiers, standardized names for licences. The action evaluates compound licence expressions against this list. No package-specific licence exceptions are configured. +- **`fail-on-severity`**: Fails on introduced known vulnerabilities rated `high` or `critical`. +- **`fail-on-scopes`**: Includes `runtime`, `development`, and `unknown`, covering application dependencies, development tools, and dependencies whose scope GitHub cannot determine. Detected transitive dependencies, packages brought in by other dependencies, are included in the review. +- **`retry-on-snapshot-warnings`**: Retries dependency comparisons with snapshot warnings for up to 120 seconds while GitHub processes dependency data. + +The workflow grants only `contents: read`, uses the automatic GitHub token, and posts no pull-request comments. Results appear in the `Dependency Review` check's job summary and logs. On failure, inspect the affected package and dependency chain, then update, remove, or replace the dependency, or review a deliberate change to `allow-licenses`. A licence outside the list requires review; the failed check is not a legal finding. Do not add a blanket exception solely to make the check pass. + +The action reviews dependency changes, not the entire existing dependency tree. It does not generate licences, verify attribution or redistribution obligations, or certify legal compliance. Its [licence detection limitation](https://github.com/actions/dependency-review-action/blob/v5.0.0/README.md#configuration-options) means an undetected licence is reported without failing the check; an unresolvable licence expression can fail. Review missing licence information manually. Existing dependencies with licences outside the allowlist are not automatically approved, and dependency updates involving those packages can fail. + +To prevent merging on a failed review, after the workflow has run, a repository administrator can select `Dependency Review` as a required status check in the branch protection rule or ruleset targeting `main`. The workflow itself does not configure branch protection. GitHub documents [required status checks](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging). + ## Contributing If you want to contribute to this repository, please refer to the [Contributing Guide](../../CONTRIBUTING.md) for more details on the pull request process and code of conduct. From 9fea29936a53335cdb752a24681caf92ffd27507 Mon Sep 17 00:00:00 2001 From: Alexander Sullivan Date: Sun, 18 Oct 2026 19:45:02 -0400 Subject: [PATCH 2/5] also on main --- .github/workflows/dependency-review.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index bf0b079c..e21cbfa9 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -1,8 +1,10 @@ name: Dependency Review on: + push: + branches: ["main"] pull_request: - branches: [main] + branches: ["main"] permissions: contents: read From 2070e5e9ac87d3c6005b7e456554ed798925ef27 Mon Sep 17 00:00:00 2001 From: Alexander Sullivan Date: Sun, 18 Oct 2026 19:50:09 -0400 Subject: [PATCH 3/5] format --- .github/workflows/dependency-review.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index e21cbfa9..d1e9cd73 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -2,9 +2,9 @@ name: Dependency Review on: push: - branches: ["main"] + branches: ['main'] pull_request: - branches: ["main"] + branches: ['main'] permissions: contents: read From a298487935ef3dcce58d661cdae2dea81c2ea183 Mon Sep 17 00:00:00 2001 From: Alexander Sullivan Date: Sun, 18 Oct 2026 19:50:28 -0400 Subject: [PATCH 4/5] only on pull request --- .github/workflows/dependency-review.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index d1e9cd73..282a2877 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -1,10 +1,8 @@ name: Dependency Review on: - push: - branches: ['main'] pull_request: - branches: ['main'] + branches: ["main"] permissions: contents: read From 560b82fc8a602cd76d19898cfaed62b6646c55a4 Mon Sep 17 00:00:00 2001 From: Alexander Sullivan Date: Sun, 18 Oct 2026 19:51:51 -0400 Subject: [PATCH 5/5] format again --- .github/workflows/dependency-review.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml index 282a2877..ec0de9fc 100644 --- a/.github/workflows/dependency-review.yaml +++ b/.github/workflows/dependency-review.yaml @@ -2,7 +2,7 @@ name: Dependency Review on: pull_request: - branches: ["main"] + branches: ['main'] permissions: contents: read