seaweedfs/.github/workflows/depsreview.yml

name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@375c5370086bfff256c37f8beec0f437e2e72ae1
chore(deps): Included dependency review > Dependency Review GitHub Action in your repository to enforce dependency reviews on your pull requests. > The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, > and warns you about the associated security vulnerabilities. > This gives you better visibility of what's changing in a pull request, > and helps prevent vulnerabilities being added to your repository. https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> 2022-04-20 01:04:54 +00:00			`name: 'Dependency Review'`
			`on: [pull_request]`

			`permissions:`
			`contents: read`

			`jobs:`
			`dependency-review:`
			`runs-on: ubuntu-latest`
			`steps:`
			`- name: 'Checkout Repository'`
Bump actions/checkout from 3 to 3.0.2 (#3483) 2022-08-22 15:33:53 +00:00			`uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b`
chore(deps): Included dependency review > Dependency Review GitHub Action in your repository to enforce dependency reviews on your pull requests. > The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests, > and warns you about the associated security vulnerabilities. > This gives you better visibility of what's changing in a pull request, > and helps prevent vulnerabilities being added to your repository. https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> 2022-04-20 01:04:54 +00:00			`- name: 'Dependency Review'`
build(deps): bump actions/dependency-review-action from 2.1.0 to 2.4.0 (#3739) 2022-09-26 15:35:23 +00:00			`uses: actions/dependency-review-action@375c5370086bfff256c37f8beec0f437e2e72ae1`