chore(deps-dev): bump the test-toolchain group across 1 directory with 2 updates #226
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-review: | |
| name: review dependencies | |
| runs-on: ubuntu-latest | |
| # The dependency-review API requires a public repo (or GitHub Advanced | |
| # Security). Skip while the repo is private so PRs don't fail on a 403. | |
| if: ${{ !github.event.repository.private }} | |
| permissions: | |
| contents: read | |
| pull-requests: write # for the summary comment | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Dependency review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 | |
| with: | |
| # Block PRs that introduce known-vulnerable dependencies. | |
| fail-on-severity: high | |
| comment-summary-in-pr: on-failure | |
| # License policy note: the ingest service is AGPL-3.0-or-later (copyleft | |
| # deps are fine there) while the packages/* substrate is Apache-2.0. | |
| # dependency-review cannot scope a policy per package, so we surface | |
| # licenses for review rather than hard-deny. Once you've confirmed it | |
| # won't flag intended copyleft deps, you can enforce a boundary by | |
| # uncommenting: | |
| # deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0 |