Improvements: #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review - Vulnerability | |
| ### | |
| # This workflow analyzes dependencies introduced by pull requests to help identify security vulnerabilities. | |
| # | |
| # To override the default configuration preset, set the `DEPENDENCY_REVIEW_VULNERABILITY_CONFIG_PRESET` variable in the repository settings. | |
| # The default preset is "vulnerability-high". This preset has this behavior: | |
| # | |
| # Fail if a dependency is found in the dependency tree with a high severity or greater. | |
| ### | |
| on: | |
| merge_group: | |
| pull_request: | |
| permissions: {} | |
| jobs: | |
| vulnerability: | |
| name: Vulnerabilities | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| # Skip on merge group events | |
| if: ${{ github.event_name == 'pull_request' }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Choose config preset | |
| id: preset | |
| env: | |
| DEFAULT_PRESET: 'vulnerability-high' | |
| OVERRIDE_PRESET: ${{ vars.DEPENDENCY_REVIEW_VULNERABILITY_CONFIG_PRESET }} | |
| ALLOWED_PRESETS: 'vulnerability-high vulnerability-high-cve-2026-34040' | |
| run: | | |
| if [ -z "${OVERRIDE_PRESET:-}" ]; then | |
| echo "Using default config preset: $DEFAULT_PRESET" | |
| CONFIG_PRESET="$DEFAULT_PRESET" | |
| else | |
| if echo " $ALLOWED_PRESETS " | grep -q " $OVERRIDE_PRESET "; then | |
| echo "Using override config preset: $OVERRIDE_PRESET" | |
| CONFIG_PRESET="$OVERRIDE_PRESET" | |
| else | |
| echo "::warning::Invalid override preset '$OVERRIDE_PRESET'. Falling back to default '$DEFAULT_PRESET'." | |
| CONFIG_PRESET="$DEFAULT_PRESET" | |
| fi | |
| fi | |
| echo "preset=$CONFIG_PRESET" | tee -a "$GITHUB_OUTPUT" | |
| - name: Dependency Review | |
| uses: smartcontractkit/.github/actions/dependency-review@dependency-review/v2 | |
| with: | |
| config-preset: ${{ steps.preset.outputs.preset }} |