goreleaser/.github/workflows/depsreview.yaml

name: dependency-review
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v3
      - uses: actions/dependency-review-action@v3
        with:
          allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, Apache-2.0, MPL-2.0
chore(ci): gitleaks Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> 2022-05-17 22:00:25 -03:00			`name: dependency-review`
feat(ci): run dependency review action on prs (#3109) > Dependency Review GitHub Action in your repository to enforce dependency > reviews on your pull requests. > The action scans for vulnerable versions of dependencies introduced by package version > changes in pull requests, > and warns you about the associated security vulnerabilities. > This gives you better visibility of what's changing in a pull request, > and helps prevent vulnerabilities being added to your repository. https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> 2022-05-14 17:48:43 -05:00			`on: [pull_request]`

			`permissions:`
			`contents: read`

			`jobs:`
			`dependency-review:`
			`runs-on: ubuntu-latest`
			`steps:`
chore(deps): bump actions/checkout from 4.0.0 to 4.1.0 (#4325) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.0.0 to 4.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v4.1.0</h2> <h2>What's Changed</h2> <ul> <li>Update README.md for V4 by <a href="https://github.com/sivapalan"><code>@sivapalan</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1452">actions/checkout#1452</a></li> <li>Add support for partial checkout filters by <a href="https://github.com/finleygn"><code>@finleygn</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1396">actions/checkout#1396</a></li> <li>Prepare 4.1.0 release by <a href="https://github.com/cory-miller"><code>@cory-miller</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1496">actions/checkout#1496</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/sivapalan"><code>@sivapalan</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1452">actions/checkout#1452</a></li> <li><a href="https://github.com/finleygn"><code>@finleygn</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/1396">actions/checkout#1396</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v4.0.0...v4.1.0">https://github.com/actions/checkout/compare/v4.0.0...v4.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v4.1.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1396">Add support for partial checkout filters</a></li> </ul> <h2>v4.0.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1067">Support fetching without the --progress option</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1436">Update to node20</a></li> </ul> <h2>v3.6.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1377">Fix: Mark test scripts with Bash'isms to be run via Bash</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/579">Add option to fetch tags even if fetch-depth > 0</a></li> </ul> <h2>v3.5.3</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1196">Fix: Checkout fail in self-hosted runners when faulty submodule are checked-in</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1287">Fix typos found by codespell</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1369">Add support for sparse checkouts</a></li> </ul> <h2>v3.5.2</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1289">Fix api endpoint for GHES</a></li> </ul> <h2>v3.5.1</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1246">Fix slow checkout on Windows</a></li> </ul> <h2>v3.5.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1237">Add new public key for known_hosts</a></li> </ul> <h2>v3.4.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1209">Upgrade codeql actions to v2</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1210">Upgrade dependencies</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1225">Upgrade <code>@actions/io</code></a></li> </ul> <h2>v3.3.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/1045">Implement branch list using callbacks from exec function</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1050">Add in explicit reference to private checkout options</a></li> <li>[Fix comment typos (that got added in <a href="https://redirect.github.com/actions/checkout/issues/770">#770</a>)](<a href="https://redirect.github.com/actions/checkout/pull/1057">actions/checkout#1057</a>)</li> </ul> <h2>v3.2.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/942">Add GitHub Action to perform release</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/967">Fix status badge</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1002">Replace datadog/squid with ubuntu/squid Docker image</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/964">Wrap pipeline commands for submoduleForeach in quotes</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1029">Update <code>@actions/io</code> to 1.1.2</a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/1039">Upgrading version to 3.2.0</a></li> </ul> <h2>v3.1.0</h2> <ul> <li><a href="https://redirect.github.com/actions/checkout/pull/939">Use <code>@actions/core</code> <code>saveState</code> and <code>getState</code></a></li> <li><a href="https://redirect.github.com/actions/checkout/pull/922">Add <code>github-server-url</code> input</a></li> </ul> <h2>v3.0.2</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/8ade135a41bc03ea155e62e844d188df1ea18608"><code>8ade135</code></a> Prepare 4.1.0 release (<a href="https://redirect.github.com/actions/checkout/issues/1496">#1496</a>)</li> <li><a href="https://github.com/actions/checkout/commit/c533a0a4cfc4962971818edcfac47a2899e69799"><code>c533a0a</code></a> Add support for partial checkout filters (<a href="https://redirect.github.com/actions/checkout/issues/1396">#1396</a>)</li> <li><a href="https://github.com/actions/checkout/commit/72f2cec99f417b1a1c5e2e88945068983b7965f9"><code>72f2cec</code></a> Update README.md for V4 (<a href="https://redirect.github.com/actions/checkout/issues/1452">#1452</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/3df4ab11eba7bda6032a0b82a6bb43b11571feac...8ade135a41bc03ea155e62e844d188df1ea18608">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4.0.0&new-version=4.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 2023-09-25 12:19:05 -03:00			`- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v3`
chore(deps): bump actions/dependency-review-action from 2 to 3 (#3551) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 2 to 3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/dependency-review-action/releases">actions/dependency-review-action's releases</a>.</em></p> <blockquote> <h2>3.0.0</h2> <h2>Breaking Changes</h2> <p>By default the action now expects <a href="https://spdx.org/licenses/">SPDX-compliant licenses</a> everywhere. If you were previously using license names in the allow or deny lists make sure they're valid!</p> <h2>What's Changed</h2> <h3>Support for external configuration files</h3> <p>You can now specify a <a href="https://github.com/actions/dependency-review-action/#configuration-file">configuration file external to your repository</a>. This allows organizations to have a single configuration file for all their repos.</p> <h3>Broader license support</h3> <p>We've added support for a much broader set of project licenses by using GitHub's <a href="https://docs.github.com/en/rest/licenses">Licenses API</a>.</p> <h3>SPDX Compliance</h3> <p>All of our license-related code now expects <a href="https://spdx.org/licenses/">SPDX-compliant licenses or expressions</a>. This allows us to standardize on a license naming scheme that already supports <code>OR</code>/<code>AND</code> expressions.</p> <h3>Disable individual checks</h3> <p>You can now use the boolean options <code>license-check</code> and <code>vulnerability-check</code> to disable either one of the checks. More information in <a href="https://github.com/actions/dependency-review-action/#configuration-options">our configuration options</a>.</p> <h2>Thanks</h2> <p>Contributors for this release include:</p> <ul> <li><a href="https://github.com/cnagadya"><code>@cnagadya</code></a></li> <li><a href="https://github.com/courtneycl"><code>@courtneycl</code></a></li> <li><a href="https://github.com/ericcornelissen"><code>@ericcornelissen</code></a></li> <li><a href="https://github.com/elireisman"><code>@elireisman</code></a></li> <li><a href="https://github.com/hmaurer"><code>@hmaurer</code></a></li> </ul> <p>Thanks everyone! <strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v2...v3.0.0">https://github.com/actions/dependency-review-action/compare/v2...v3.0.0</a></p> <h2>2.5.1</h2> <p>Adding some quality-of-life improvements to the local development experience. You can now pass a flag to the <code>scripts/scan_pr</code> script using the <code>-c/--config-file</code> flags to use an external configuration file:</p> <p>Example:</p> <pre><code> scripts/scan_pr https://github.com/actions/dependency-review-action/pull/294 </code></pre> <h2>2.5.0</h2> <p>Fallback on GitHub Licenses API data for missing Dependency Review API Licenses. This should improve our license coverage.</p> <h2>2.4.1</h2> <p>This patch release fixes the bugs below:</p> <ul> <li>Display the dependency name instead of the manifest name in the detailed list of dependents.</li> <li>Fix an issue where undefined GHSAs would remove filter out all changes.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/dependency-review-action/commit/30d582111533d59ab793fd9f971817241654f3ec"><code>30d5821</code></a> Bumping version number</li> <li><a href="https://github.com/actions/dependency-review-action/commit/6e42c3395a80c4f7519b12a545f0848373039e0e"><code>6e42c33</code></a> Remove defaults from the recently added fields.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/a3074cd69966a0aed6bc666d73ca406262fda359"><code>a3074cd</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/327">#327</a> from actions/adding-extra-options</li> <li><a href="https://github.com/actions/dependency-review-action/commit/51a29d6960861d139fbbab032848494553797d03"><code>51a29d6</code></a> Updating action.yml to include <code>*-check</code> config</li> <li><a href="https://github.com/actions/dependency-review-action/commit/235a221cf40bec2750c6a87ab87f604e12eca4e7"><code>235a221</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/324">#324</a> from actions/readme-update</li> <li><a href="https://github.com/actions/dependency-review-action/commit/9b3a7f61dd4fbd3b6757cc7876ba1c900244da9c"><code>9b3a7f6</code></a> Minor README tweaks.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/a4761312ac8cd71b4ce101ba780165af3d17e864"><code>a476131</code></a> Add <code>pull_request</code> to the list of events that don't need refs.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/28c7c8c3143bbab053a8419206b7b30b046f446e"><code>28c7c8c</code></a> Set the correct default for license-check in README.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/9da0fd4871b9808ca86f37f2cf5f240bc37b965a"><code>9da0fd4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/325">#325</a> from actions/dependabot/npm_and_yarn/eslint-plugin-je...</li> <li><a href="https://github.com/actions/dependency-review-action/commit/fe45fd66456a8ef0152070d3e6e5cc66ac10abe9"><code>fe45fd6</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/326">#326</a> from actions/dependabot/npm_and_yarn/esbuild-register...</li> <li>Additional commits viewable in <a href="https://github.com/actions/dependency-review-action/compare/v2...v3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/dependency-review-action&package-manager=github_actions&previous-version=2&new-version=3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 2022-11-14 09:38:04 -03:00			`- uses: actions/dependency-review-action@v3`
chore(ci): prevent gpl deps Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> 2022-07-06 09:50:26 -03:00			`with:`
			`allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, Apache-2.0, MPL-2.0`