From 54296d922a6a6b286ed62b40ee12e570d0bc8979 Mon Sep 17 00:00:00 2001 From: Jeff Martin Date: Thu, 9 Jul 2026 12:22:22 -0500 Subject: [PATCH] Add Dependency Review workflow and lock its actions Runs actions/dependency-review-action on pull requests targeting main to flag vulnerable or policy-violating dependency changes before merge. The lockfile is regenerated so the new workflow's pins (checkout, and dependency-review-action narrowed to v4.9.0) are recorded and verifiable. --- .github/workflows/actions.lock | 8 ++++++++ .github/workflows/dependency-review.yml | 19 +++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 8356e11..a2ed652 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -6,6 +6,9 @@ workflows: '.github/workflows/ci.yml': - 'actions/checkout@v4.3.1' - 'actions/setup-go@v5.6.0' + '.github/workflows/dependency-review.yml': + - 'actions/checkout@v4.3.1' + - 'actions/dependency-review-action@v4.9.0' '.github/workflows/release.yml': - 'actions/checkout@v4.3.1' - 'actions/setup-go@v5.6.0' @@ -15,6 +18,11 @@ dependencies: commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5' owner_id: 44036562 repo_id: 197814629 + 'actions/dependency-review-action@v4.9.0': + ref: 'v4.9.0' + commit: 'sha1-2031cfc080254a8a887f58cffee85186f0e49e48' + owner_id: 44036562 + repo_id: 476372928 'actions/setup-go@v5.6.0': ref: 'v5.6.0' commit: 'sha1-40f1582b2485089dde7abd97c1529aa768e1baff' diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..e84814a --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,19 @@ +# This workflow is managed by gh actions-lock. + +name: Dependency Review + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +jobs: + dependency-review: + name: Dependency Review + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4.3.1 + + - uses: actions/dependency-review-action@v4.9.0