mirror of
https://github.com/allthingslinux/tux.git
synced 2024-10-02 16:43:12 +00:00
33 lines
1 KiB
YAML
33 lines
1 KiB
YAML
# Dependency Review Action
|
|
#
|
|
# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
|
|
#
|
|
# Source repository: https://github.com/actions/dependency-review-action
|
|
name: 'Dependency Review'
|
|
on: [pull_request]
|
|
|
|
permissions:
|
|
contents: write
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
dependency-review:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: 'Checkout Repository'
|
|
uses: actions/checkout@v3
|
|
|
|
# Install Python
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v5.0.0
|
|
with:
|
|
python-version: 3.11
|
|
|
|
# Install Poetry
|
|
- name: Poetry Install
|
|
uses: knowsuchagency/poetry-install@v2
|
|
|
|
# Run Poetry commands
|
|
- name: Update Python Poetry package
|
|
uses: dishapatel010/action-poetry-package-update@V2.0.1
|