diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml index 6164bee..4b1adff 100644 --- a/.github/workflows/dependencies.yml +++ b/.github/workflows/dependencies.yml @@ -33,4 +33,21 @@ jobs: env: DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: runtimeClasspath DEPENDENCY_GRAPH_INCLUDE_PROJECTS: "^:(?!(buildSrc|test-)).*" - run: ./gradlew allDeps --configuration runtimeClasspath \ No newline at end of file + run: ./gradlew allDeps --configuration runtimeClasspath + + check-dependencies: + if: github.event_name == 'pull_request' + needs: submit-dependencies + permissions: + pull-requests: write + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.0.0 + - name: Dependency Review + uses: actions/dependency-review-action@v3 + with: + comment-summary-in-pr: true + # Think carefully about the implications of adding dependencies with new licence types. + # Licence ids: https://spdx.org/licenses/ + # License risks: https://brainhub.eu/library/open-source-licenses-to-avoid + allow-licenses: MIT