docs: improve best practices #9
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'Dependency Review' | |
| on: | |
| pull_request: | |
| branches: [ "main" ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - id: checkout | |
| uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3 | |
| with: | |
| persist-credentials: false | |
| - name: 'Dependency Review' | |
| uses: actions/dependency-review-action@5bbc3ba658137598168acb2ab73b21c432dd411b # v4.2.5 | |
| with: | |
| # fail if a pull request introduce vulnerabilities of level "low" or higher | |
| fail-on-severity: low | |
| # allowed licenses in SPDX format, the action will fail if a new dependencies with a license not in this list is introduced | |
| # if the license cant be detected, the action will inform but not fail | |
| allow-licenses: 'Apache-2.0, MIT, GPL-3.0-or-later, MPL-2.0' | |
| # threshold for the OpenSSF Scorecard level, the action will get a warning in the CI | |
| warn-on-openssf-scorecard-level: 3 |