Add Dependency Review workflow - #18
Merged
Merged
Conversation
Runs actions/dependency-review-action on pull requests targeting main to flag vulnerable or policy-violating dependency changes before merge. The lockfile is regenerated so the new workflow's pins (checkout, and dependency-review-action narrowed to v4.9.0) are recorded and verifiable.
There was a problem hiding this comment.
✅ Ready to approve
The new workflow and lockfile updates are consistent, correctly pinned, and align with the stated PR intent without introducing risky behavior.
Note: this review does not count toward required approvals for merging.
Pull request overview
Adds a new GitHub Actions “Dependency Review” workflow to run actions/dependency-review-action on pull requests targeting main, and updates the gh actions-lock lockfile to record the new workflow’s pinned action refs/commits.
Changes:
- Introduces
.github/workflows/dependency-review.ymlto run dependency review on PRs intomain. - Pins
actions/checkoutandactions/dependency-review-actionto exact versions in the new workflow. - Regenerates
.github/workflows/actions.lockto include the new workflow and dependency pin.
File summaries
| File | Description |
|---|---|
| .github/workflows/dependency-review.yml | Adds a PR-triggered Dependency Review workflow with pinned action versions and minimal read permissions. |
| .github/workflows/actions.lock | Records the new workflow’s pinned actions and commit SHAs in the lockfile. |
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0
- Review effort level: Low
Note
Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a
Dependency ReviewGitHub Actions workflow that runsactions/dependency-review-actionon pull requests targetingmain, and regenerates.github/workflows/actions.lockto record the new workflow's pins.Why
Dependency Review surfaces vulnerable or policy-violating dependency changes in the PR diff before they merge — a natural fit for a repo whose whole purpose is supply-chain pinning hygiene.
Details
.github/workflows/dependency-review.yml(on: pull_request → main, permissions: contents: read)actions/checkout@v4.3.1,actions/dependency-review-action@v4.9.0gh actions-locknarrowed@v4→@v4.9.0and added both pins to the lockfile.Verification
gh actions-lock --no-fix --json | jq .valid→true(no drift)