From 8964512b1ac3029156ba658163c45cd363a4eb2f Mon Sep 17 00:00:00 2001 From: Matthias Linhuber Date: Thu, 27 Aug 2026 17:44:53 +0200 Subject: [PATCH] chore(ci): fail PRs that introduce vulnerable dependencies Adds the shared EduIDE/.github dependency-review reusable workflow as a job in the existing CI workflow. It fails a PR that introduces a dependency with a known advisory at high severity or above, and stays quiet about anything already on main. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01QLGHEpzx7D9NYHx4fCmHa9 --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d9272c6..c68b2ea 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -34,3 +34,8 @@ jobs: - run: npm ci - run: npm run typecheck - run: npm run build + + # Renovate reports vulnerabilities already on main; this one blocks a PR that + # is about to add a new dependency with a known advisory. + dependency-review: + uses: EduIDE/.github/.github/workflows/dependency-review.yml@v1