From ab2b23336778c2ea7ab4b70ecdb3e57d159d346f Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:38:52 +0000
Subject: [PATCH 1/2] Enforce severity and license gates in dependency-review
 workflow

Enable fail-on-severity (high), deny-licenses (GPL/LGPL/AGPL family,
incompatible with this MIT project) and retry-on-snapshot-warnings in
the Dependency Review action so PRs introducing vulnerable or
incompatibly-licensed dependencies are blocked, not just commented on.

Refs java-helpers/simple-builders#160

Co-Authored-By: Andreas Igel <andreas.igel@computacenter.com>
---
 .github/workflows/dependency-review.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index d19e21b7..76f93a8b 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -34,6 +34,9 @@ jobs:
         # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
         with:
           comment-summary-in-pr: always
-        #   fail-on-severity: moderate
-        #   deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later
-        #   retry-on-snapshot-warnings: true
+          # Fail the PR when it introduces a vulnerability at or above this severity.
+          fail-on-severity: high
+          # Block copyleft / incompatible licenses that conflict with this MIT project.
+          deny-licenses: GPL-1.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, AGPL-3.0-or-later
+          # Snapshot dependency data can lag right after a push; retry instead of failing spuriously.
+          retry-on-snapshot-warnings: true

From f04ce18a0cc3ca72a61007d1e4539d3f088a5411 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:43:33 +0000
Subject: [PATCH 2/2] Run dependency review via pull_request_target so it works
 on fork PRs

Co-Authored-By: Andreas Igel <andreas.igel@computacenter.com>
---
 .github/workflows/dependency-review.yml | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index e4ef5126..6281ff4a 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -9,26 +9,30 @@
 # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 name: 'Dependency review'
 on:
-  pull_request:
+  # Use pull_request_target so the review also works for PRs opened from forks.
+  # A plain `pull_request` run from a fork receives a read-only GITHUB_TOKEN, so
+  # `comment-summary-in-pr` cannot post its summary ("Unable to write summary to
+  # pull-request. Make sure you are giving this workflow the permission
+  # 'pull-requests: write'"). pull_request_target runs in the base-repo context
+  # with a read/write token, so the summary is posted on fork PRs too.
+  #
+  # This is safe here because dependency-review-action never checks out or executes
+  # PR-supplied code: it only compares the PR's base/head via the GitHub
+  # dependency-graph/advisory API. No checkout step is used, so untrusted code is
+  # never run with the elevated token.
+  pull_request_target:
     branches: [ "main" ]
 
-# If using a dependency submission action in this workflow this permission will need to be set to:
-#
-# permissions:
-#   contents: write
-#
-# https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
 permissions:
   contents: read
-  # Write permissions for pull-requests are required for using the `comment-summary-in-pr` option, comment out if you aren't using this option
+  # Required so `comment-summary-in-pr` can post the review summary (works for
+  # fork PRs only because of the pull_request_target trigger above).
   pull-requests: write
 
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - name: 'Checkout repository'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.