Support -D system properties for compiler options (#275) #439
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependency Review Action | |
| # | |
| # This Action will scan dependency manifest files that change as part of a Pull Request, | |
| # surfacing known-vulnerable versions of the packages declared or updated in the PR. | |
| # Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable | |
| # packages will be blocked from merging. | |
| # | |
| # Source repository: https://github.com/actions/dependency-review-action | |
| # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement | |
| name: 'Dependency review' | |
| on: | |
| # Use pull_request_target so the review also works for PRs opened from forks. | |
| # A plain `pull_request` run from a fork receives a read-only GITHUB_TOKEN, so | |
| # `comment-summary-in-pr` cannot post its summary ("Unable to write summary to | |
| # pull-request. Make sure you are giving this workflow the permission | |
| # 'pull-requests: write'"). pull_request_target runs in the base-repo context | |
| # with a read/write token, so the summary is posted on fork PRs too. | |
| # | |
| # This is safe here because dependency-review-action never checks out or executes | |
| # PR-supplied code: it only compares the PR's base/head via the GitHub | |
| # dependency-graph/advisory API. No checkout step is used, so untrusted code is | |
| # never run with the elevated token. | |
| pull_request_target: | |
| branches: [ "main" ] | |
| # Cancel superseded runs for the same PR to save runner minutes. | |
| concurrency: | |
| group: dependency-review-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # If using a dependency submission action in this workflow this permission will need to be set to: | |
| # | |
| # permissions: | |
| # contents: write | |
| # | |
| # https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api | |
| permissions: | |
| contents: read | |
| # Required so `comment-summary-in-pr` can post the review summary (works for | |
| # fork PRs only because of the pull_request_target trigger above). | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| # Dependency review requires the dependency graph to be enabled, which is | |
| # not the case for forks. Skipping it on fork repositories avoids failing | |
| # checks on every fork PR (see #243). | |
| if: github.event.repository.fork == false | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: 'Dependency Review' | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options. | |
| with: | |
| # Only post/refresh the PR summary comment when the review actually | |
| # fails (a vulnerability or denied license). This avoids spamming | |
| # every PR with a comment whose only content is the benign | |
| # "No snapshots were found for the head SHA" warning: for fork PRs | |
| # GitHub has only the manifest-derived dependency graph (no submitted | |
| # snapshot for the fork head, and one can't be produced without | |
| # building untrusted fork code with a write token; dependency-submission.yml | |
| # only submits snapshots for main). The check still runs and still fails | |
| # on real issues; the warning is only visible in the Actions run log. | |
| comment-summary-in-pr: on-failure | |
| # Fail the PR when it introduces a vulnerability at or above this severity. | |
| fail-on-severity: high | |
| # Fail closed with licenses derived from the project's full dependency tree, | |
| # replacing the deprecated deny-licenses option. | |
| allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0 |