ci(deps): bump the github-actions group across 1 directory with 4 updates #38

	# © 2026 NetApp, Inc. All Rights Reserved.
	# SPDX-License-Identifier: Apache-2.0
	# See the NOTICE file in the repo root for trademark and attribution details.

	name: Dependency Review

	# Flags known-vulnerable or incompatibly licensed dependencies as they are
	# introduced, rather than after they land. Covers the pip requirements files,
	# go.mod, Terraform providers, and GitHub Actions.
	#
	# Runs on pull_request only - the action diffs the PR against its base, so it
	# has nothing to compare on a push.

	on:
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	review:
	name: Review dependency changes
	runs-on: ubuntu-latest
	permissions:
	contents: read
	pull-requests: write # post the summary comment
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
	with:
	egress-policy: audit

	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

	- uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
	with:
	# Block only what a contributor can act on. Advisories below high are
	# reported in the summary without failing the build.
	fail-on-severity: high
	# This repo is Apache-2.0; copyleft dependencies would create a
	# licensing problem for downstream users of the examples.
	deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0, LGPL-2.1, LGPL-3.0
	comment-summary-in-pr: on-failure

Navigation Menu