From b8ef8f89367771db02e9fc49f127cb657b9493ab Mon Sep 17 00:00:00 2001 From: Burt Gardner Date: Tue, 25 Aug 2026 12:33:08 +0000 Subject: [PATCH] ci: review the dependencies a pull request adds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The weekly audit reports this repository as having no dependency-review workflow, and it is right: every other repository under audit has one, and this is the only one handling checkout and payment. CodeQL reads the code written here. Nothing read the code taken on trust — NuGet packages, npm packages, and the Actions the workflows consume — so a pull request could add a known-vulnerable dependency and meet no objection until Dependabot raised it after the merge. Pull requests only: the action diffs a base against a head and has nothing to compare on a push. fail-on-severity is moderate rather than high, because a moderate finding in a checkout path is not a rounding error. Pinned by SHA, persist-credentials off, contents: read — the shape the other workflows in this repository already use. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01VrPrR9jZDHewD5dKR5dyRk --- .github/workflows/dependency-review.yml | 40 +++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..0f7596e --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,40 @@ +name: Dependency review + +# Refuses a pull request that ADDS a vulnerable dependency, while the change is +# still a proposal rather than something already on main. CodeQL reads the code +# this repository writes; this reads the code it takes on trust — NuGet, npm, +# and the Actions the workflows above consume. +# +# Pull requests only, by design: the action diffs a base against a head, so +# there is nothing for it to compare on a push. + +on: + pull_request: + branches: [main] + +permissions: + contents: read + +concurrency: + group: dependency-review-${{ github.ref }} + cancel-in-progress: true + +jobs: + review: + name: Dependency review + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # Nothing here pushes; the job token has no use after the clone. + persist-credentials: false + + - name: Review the dependencies this pull request adds + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + # Moderate rather than high: this store handles checkout and payment, + # and a moderate finding in that path is not a rounding error. + fail-on-severity: moderate + comment-summary-in-pr: on-failure