goreleaser/.github/workflows/depsreview.yaml

name: dependency-review
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/dependency-review-action@v2
        with:
          allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, Apache-2.0, MPL-2.0
chore(ci): gitleaks Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> 2022-05-18 03:00:25 +02:00			`name: dependency-review`
feat(ci): run dependency review action on prs (#3109) > Dependency Review GitHub Action in your repository to enforce dependency > reviews on your pull requests. > The action scans for vulnerable versions of dependencies introduced by package version > changes in pull requests, > and warns you about the associated security vulnerabilities. > This gives you better visibility of what's changing in a pull request, > and helps prevent vulnerabilities being added to your repository. https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> 2022-05-15 00:48:43 +02:00			`on: [pull_request]`

			`permissions:`
			`contents: read`

			`jobs:`
			`dependency-review:`
			`runs-on: ubuntu-latest`
			`steps:`
chore(ci): gitleaks Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> 2022-05-18 03:00:25 +02:00			`- uses: actions/checkout@v3`
chore(deps): bump actions/dependency-review-action from 1 to 2 (#3164) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 1 to 2. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/v1...v2) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 2022-06-16 13:55:20 +02:00			`- uses: actions/dependency-review-action@v2`
chore(ci): prevent gpl deps Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> 2022-07-06 14:50:26 +02:00			`with:`
			`allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, Apache-2.0, MPL-2.0`