Create dependency-review.yml

[auvipy]

No description provided.

[cclauss]

I have been trying this out on several Python projects and am unable to get this Action to fail. lint-python is currently running https://pypi.org/project/safety which fails on known vulnerabilities (like earlier versions of setuptools in #854).

Is there a Python dependency that we could add to this project that will prove that this Action can actually fail?

[auvipy]

I think we can merge this as Dependency Review / dependency-review (pull_request) is passing and working

[cclauss]

we can merge this as Dependency Review / dependency-review (pull_request) is passing

The failing lint_python test does not worry me. It fails because safety found the CVE-2022-40897 vulnerability in setuptools which was fixed in:

• Fix failing GitHub Action lint_python.yml #854 (merged)

Why does dependency-review not find this CVE-2022-40897 vulnerability?

As stated above, my worry is that there is no proof that dependency-review can ever fail on a Python project.

[JonathanHuot]

When the setuptools version is added in requirements.txt, it is detecting it correctly and merging is blocked.

Note that different lang has different checks, according to https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph#supported-package-ecosystems

I suppose it becomes trickier when dependencies are installed in GitHub Actions without versions, as the Dependency API won't have a way to check changes..

I think we're good to proceed even tho it seems a duplicate of safety check which is also running it.

[cclauss]

#871 fixes some of the remaining issues.