From f4a943f47e7570df5bd784579d2dcf72fbd329db Mon Sep 17 00:00:00 2001 From: Eduardo Apolinario Date: Wed, 23 Oct 2024 18:21:19 -0400 Subject: [PATCH 1/3] Add dependency review gh workflow Signed-off-by: Eduardo Apolinario --- .github/workflows/dependency-review.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000000..16ee3e5000 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,24 @@ +name: 'Dependency Review' +on: [pull_request] +permissions: + contents: read + pull-requests: write +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: 'Checkout Repository' + uses: actions/checkout@v4 + - name: Dependency Review + uses: actions/dependency-review-action@v4 + with: + comment_summary_in_pr: on-failure + # Licenses need to come from https://spdx.org/licenses/ + deny-licenses: + - GPL-1.0-only + - GPL-1.0-or-later + - GPL-2.0-only + - GPL-2.0-or-later + - GPL-3.0-only + - GPL-3.0-or-later + From 7645652462cda9cf686c143633648b4146e7870c Mon Sep 17 00:00:00 2001 From: Eduardo Apolinario Date: Wed, 23 Oct 2024 18:25:27 -0400 Subject: [PATCH 2/3] Comma-separated list of licenses Signed-off-by: Eduardo Apolinario --- .github/workflows/dependency-review.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 16ee3e5000..fcce42bbed 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -14,11 +14,5 @@ jobs: with: comment_summary_in_pr: on-failure # Licenses need to come from https://spdx.org/licenses/ - deny-licenses: - - GPL-1.0-only - - GPL-1.0-or-later - - GPL-2.0-only - - GPL-2.0-or-later - - GPL-3.0-only - - GPL-3.0-or-later + deny-licenses: GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later From 6225ebcb66051d5770104e327af9b6d0307ace09 Mon Sep 17 00:00:00 2001 From: Eduardo Apolinario Date: Wed, 23 Oct 2024 18:28:31 -0400 Subject: [PATCH 3/3] Fix use of comment-on-pr Signed-off-by: Eduardo Apolinario --- .github/workflows/dependency-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index fcce42bbed..a9a7d2ed8d 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -12,7 +12,7 @@ jobs: - name: Dependency Review uses: actions/dependency-review-action@v4 with: - comment_summary_in_pr: on-failure + comment-summary-in-pr: on-failure # Licenses need to come from https://spdx.org/licenses/ deny-licenses: GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later