goreleaser/.github/workflows/depsreview.yaml

name: dependency-review
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
      - uses: actions/dependency-review-action@v3
        with:
          allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, Apache-2.0, MPL-2.0
chore(ci): gitleaks Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> 2022-05-18 03:00:25 +02:00			`name: dependency-review`
feat(ci): run dependency review action on prs (#3109) > Dependency Review GitHub Action in your repository to enforce dependency > reviews on your pull requests. > The action scans for vulnerable versions of dependencies introduced by package version > changes in pull requests, > and warns you about the associated security vulnerabilities. > This gives you better visibility of what's changing in a pull request, > and helps prevent vulnerabilities being added to your repository. https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com> 2022-05-15 00:48:43 +02:00			`on: [pull_request]`

			`permissions:`
			`contents: read`

			`jobs:`
			`dependency-review:`
			`runs-on: ubuntu-latest`
			`steps:`
chore(deps): bump actions/checkout from 3.0.2 to 3.1.0 (#3441) Bumps [actions/checkout](https://github.com/actions/checkout) from 3.0.2 to 3.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v3.1.0</h2> <h2>What's Changed</h2> <ul> <li>Inject GitHub host to be able to clone from another GitHub instance by <a href="https://github.com/peter-murray"><code>@peter-murray</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/922">actions/checkout#922</a></li> <li>Bump <code>@actions/core</code> to 1.10.0 by <a href="https://github.com/rentziass"><code>@rentziass</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/939">actions/checkout#939</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/peter-murray"><code>@peter-murray</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/922">actions/checkout#922</a></li> <li><a href="https://github.com/rentziass"><code>@rentziass</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/939">actions/checkout#939</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v3.0.2...v3.1.0">https://github.com/actions/checkout/compare/v3.0.2...v3.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v3.1.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/939">Use <code>@actions/core</code> <code>saveState</code> and <code>getState</code></a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/922">Add <code>github-server-url</code> input</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/770">Add input <code>set-safe-directory</code></a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/762">Fixed an issue where checkout failed to run in container jobs due to the new git setting <code>safe.directory</code></a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/744">Bumped various npm package versions</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/689">Update to node 16</a></li> </ul> <h2>v2.3.1</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/284">Fix default branch resolution for .wiki and when using SSH</a></li> </ul> <h2>v2.3.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/278">Fallback to the default branch</a></li> </ul> <h2>v2.2.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/258">Fetch all history for all tags and branches when fetch-depth=0</a></li> </ul> <h2>v2.1.1</h2> <ul> <li>Changes to support GHES (<a href="https://github-redirect.dependabot.com/actions/checkout/pull/236">here</a> and <a href="https://github-redirect.dependabot.com/actions/checkout/pull/248">here</a>)</li> </ul> <h2>v2.1.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/191">Group output</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/199">Changes to support GHES alpha release</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/184">Persist core.sshCommand for submodules</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/163">Add support ssh</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/179">Convert submodule SSH URL to HTTPS, when not using SSH</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/157">Add submodule support</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/144">Follow proxy settings</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/141">Fix ref for pr closed event when a pr is merged</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/128">Fix issue checking detached when git less than 2.22</a></li> </ul> <h2>v2.0.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/108">Do not pass cred on command line</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/107">Add input persist-credentials</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/104">Fallback to REST API to download repo</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8"><code>93ea575</code></a> Prepare release v3.1.0 (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/940">#940</a>)</li> <li><a href="https://github.com/actions/checkout/commit/6a84743051be17cee477b0a26bd866b5dba996e4"><code>6a84743</code></a> Bump <code>@actions/core</code> to 1.10.0 (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/939">#939</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e6d535c99c374d0c3f6d8cd8086a57b43c6c700a"><code>e6d535c</code></a> Inject GitHub host to be able to clone from another GitHub instance (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/922">#922</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/2541b1294d2704b0964813337f33b291d3f8596b...93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=3.0.2&new-version=3.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 2022-10-05 14:38:34 +02:00			`- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3`
chore(deps): bump actions/dependency-review-action from 2 to 3 (#3551) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 2 to 3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/dependency-review-action/releases">actions/dependency-review-action's releases</a>.</em></p> <blockquote> <h2>3.0.0</h2> <h2>Breaking Changes</h2> <p>By default the action now expects <a href="https://spdx.org/licenses/">SPDX-compliant licenses</a> everywhere. If you were previously using license names in the allow or deny lists make sure they're valid!</p> <h2>What's Changed</h2> <h3>Support for external configuration files</h3> <p>You can now specify a <a href="https://github.com/actions/dependency-review-action/#configuration-file">configuration file external to your repository</a>. This allows organizations to have a single configuration file for all their repos.</p> <h3>Broader license support</h3> <p>We've added support for a much broader set of project licenses by using GitHub's <a href="https://docs.github.com/en/rest/licenses">Licenses API</a>.</p> <h3>SPDX Compliance</h3> <p>All of our license-related code now expects <a href="https://spdx.org/licenses/">SPDX-compliant licenses or expressions</a>. This allows us to standardize on a license naming scheme that already supports <code>OR</code>/<code>AND</code> expressions.</p> <h3>Disable individual checks</h3> <p>You can now use the boolean options <code>license-check</code> and <code>vulnerability-check</code> to disable either one of the checks. More information in <a href="https://github.com/actions/dependency-review-action/#configuration-options">our configuration options</a>.</p> <h2>Thanks</h2> <p>Contributors for this release include:</p> <ul> <li><a href="https://github.com/cnagadya"><code>@cnagadya</code></a></li> <li><a href="https://github.com/courtneycl"><code>@courtneycl</code></a></li> <li><a href="https://github.com/ericcornelissen"><code>@ericcornelissen</code></a></li> <li><a href="https://github.com/elireisman"><code>@elireisman</code></a></li> <li><a href="https://github.com/hmaurer"><code>@hmaurer</code></a></li> </ul> <p>Thanks everyone! <strong>Full Changelog</strong>: <a href="https://github.com/actions/dependency-review-action/compare/v2...v3.0.0">https://github.com/actions/dependency-review-action/compare/v2...v3.0.0</a></p> <h2>2.5.1</h2> <p>Adding some quality-of-life improvements to the local development experience. You can now pass a flag to the <code>scripts/scan_pr</code> script using the <code>-c/--config-file</code> flags to use an external configuration file:</p> <p>Example:</p> <pre><code> scripts/scan_pr https://github.com/actions/dependency-review-action/pull/294 </code></pre> <h2>2.5.0</h2> <p>Fallback on GitHub Licenses API data for missing Dependency Review API Licenses. This should improve our license coverage.</p> <h2>2.4.1</h2> <p>This patch release fixes the bugs below:</p> <ul> <li>Display the dependency name instead of the manifest name in the detailed list of dependents.</li> <li>Fix an issue where undefined GHSAs would remove filter out all changes.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/dependency-review-action/commit/30d582111533d59ab793fd9f971817241654f3ec"><code>30d5821</code></a> Bumping version number</li> <li><a href="https://github.com/actions/dependency-review-action/commit/6e42c3395a80c4f7519b12a545f0848373039e0e"><code>6e42c33</code></a> Remove defaults from the recently added fields.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/a3074cd69966a0aed6bc666d73ca406262fda359"><code>a3074cd</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/327">#327</a> from actions/adding-extra-options</li> <li><a href="https://github.com/actions/dependency-review-action/commit/51a29d6960861d139fbbab032848494553797d03"><code>51a29d6</code></a> Updating action.yml to include <code>*-check</code> config</li> <li><a href="https://github.com/actions/dependency-review-action/commit/235a221cf40bec2750c6a87ab87f604e12eca4e7"><code>235a221</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/324">#324</a> from actions/readme-update</li> <li><a href="https://github.com/actions/dependency-review-action/commit/9b3a7f61dd4fbd3b6757cc7876ba1c900244da9c"><code>9b3a7f6</code></a> Minor README tweaks.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/a4761312ac8cd71b4ce101ba780165af3d17e864"><code>a476131</code></a> Add <code>pull_request</code> to the list of events that don't need refs.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/28c7c8c3143bbab053a8419206b7b30b046f446e"><code>28c7c8c</code></a> Set the correct default for license-check in README.</li> <li><a href="https://github.com/actions/dependency-review-action/commit/9da0fd4871b9808ca86f37f2cf5f240bc37b965a"><code>9da0fd4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/325">#325</a> from actions/dependabot/npm_and_yarn/eslint-plugin-je...</li> <li><a href="https://github.com/actions/dependency-review-action/commit/fe45fd66456a8ef0152070d3e6e5cc66ac10abe9"><code>fe45fd6</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/dependency-review-action/issues/326">#326</a> from actions/dependabot/npm_and_yarn/esbuild-register...</li> <li>Additional commits viewable in <a href="https://github.com/actions/dependency-review-action/compare/v2...v3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/dependency-review-action&package-manager=github_actions&previous-version=2&new-version=3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> 2022-11-14 14:38:04 +02:00			`- uses: actions/dependency-review-action@v3`
chore(ci): prevent gpl deps Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> 2022-07-06 14:50:26 +02:00			`with:`
			`allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, Apache-2.0, MPL-2.0`