Update dependency-review.yml #2
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Dependency Review' | |
| on: [pull_request] | |
| permissions: | |
| contents: read | |
| # This permission is required for the action to add a summary to the PR | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: 'Checkout Repository' | |
| uses: actions/checkout@v3 | |
| - name: 'Dependency Review' | |
| uses: actions/dependency-review-action@66e0e6c6f5902d8a9e40a18db3fc6a08455e8ede | |
| with: | |
| # options are: low, moderate, high, critical | |
| fail-on-severity: high | |
| # Print a summary in the PR, describing any findings during the scan | |
| comment-summary-in-pr: always | |
| allow-ghsas: "GHSA-4x9r-j582-cgr8, GHSA-qmf9-6jqf-j8fq" |