Skip to content

ci: [#279] add dependency review workflow - #292

Open
snowsadh wants to merge 1 commit into
pyfenn:mainfrom
snowsadh:ci/dependency-review-279
Open

ci: [#279] add dependency review workflow#292
snowsadh wants to merge 1 commit into
pyfenn:mainfrom
snowsadh:ci/dependency-review-279

Conversation

@snowsadh

Copy link
Copy Markdown

Summary

  • add dependency review for pull requests targeting main
  • pin actions to immutable commit SHAs
  • use least-privilege permissions
  • cancel stale workflow runs when a pull request is updated

Validation

  • validated YAML syntax
  • ran zizmor --pedantic .github/workflows/dependency-review.yaml
  • no zizmor findings reported

Note

The dependency review action requires GitHub's Dependency Graph to be enabled for the repository.

Fixes #279

@ApusBerliozi

Copy link
Copy Markdown
Contributor

Thx for your work @snowsadh! We will turn Dependency Graph, and merge your PR right after it

Please star our project to help us grow! You can also join our Discord server if you want :)

@snowsadh

Copy link
Copy Markdown
Author

Thanks! Glad to contribute.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

code quality enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add dependency review to GitHub workflow

2 participants