Dependency graph

.github/workflows/github-dependency-graph.yml

@@ -1,4 +1,4 @@
-name: github-dependency-graph
+name: dependency-graph
 
 on:
   push:
@@ -7,12 +7,23 @@ on:
 
 jobs:
   submit-dependency-graph:
+    if: github.repository == 'finos/morphir-scala' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: coursier/cache-action@v6
-    - uses: actions/setup-java@v4
-      with:
-        distribution: 'temurin'
-        java-version: '17'
-    - uses: ckipp01/mill-dependency-submission@v1
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: coursier/cache-action@v6
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+
+      # We want to see the transmitted graph in the logs
+      - run:  ./mill --import ivy:io.chris-kipp::mill-github-dependency-graph::0.2.5 showNamed io.kipp.mill.github.dependency.graph.Graph/generate
+
+      # Actually upload the graph
+      - uses: ckipp01/mill-dependency-submission@v1

.github/workflows/github-dependency-review.yml

@@ -0,0 +1,14 @@
+name: 'Dependency Review'
+on: [pull_request]
+permissions:
+  contents: read
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v3
+        with:
+          fail-on-severity: high