From 2d6b3ad8b16213ce3b9f783df818305a5640c9e5 Mon Sep 17 00:00:00 2001 From: Hans <11695964+hupling@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:16:56 +0100 Subject: [PATCH 1/7] Create action-dependency-review.yml --- .../actions/action-dependency-review.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 action-templates/actions/action-dependency-review.yml diff --git a/action-templates/actions/action-dependency-review.yml b/action-templates/actions/action-dependency-review.yml new file mode 100644 index 0000000..f147226 --- /dev/null +++ b/action-templates/actions/action-dependency-review.yml @@ -0,0 +1,14 @@ +name: dependency-review +runs: + using: "composite" + steps: + dependency-review: + - name: Checkout code + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Dependency Review + uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0 + with: + config-file: it-at-m/.github/workflow-configs/dependency_review.yaml@main + + + From 4c8d61d91ab712c464088b68528dfca3b61f421b Mon Sep 17 00:00:00 2001 From: Hans <11695964+hupling@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:20:15 +0100 Subject: [PATCH 2/7] Rename action-templates/actions/action-dependency-review.yml to action-templates/actions/action-dependency-review/action-dependency-review.yml --- .../{ => action-dependency-review}/action-dependency-review.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename action-templates/actions/{ => action-dependency-review}/action-dependency-review.yml (100%) diff --git a/action-templates/actions/action-dependency-review.yml b/action-templates/actions/action-dependency-review/action-dependency-review.yml similarity index 100% rename from action-templates/actions/action-dependency-review.yml rename to action-templates/actions/action-dependency-review/action-dependency-review.yml From 751da8b0d716299e5f8bc63df95d33c5183199de Mon Sep 17 00:00:00 2001 From: Hans <11695964+hupling@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:20:45 +0100 Subject: [PATCH 3/7] Rename action-dependency-review.yml to action.yml --- .../{action-dependency-review.yml => action.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename action-templates/actions/action-dependency-review/{action-dependency-review.yml => action.yml} (100%) diff --git a/action-templates/actions/action-dependency-review/action-dependency-review.yml b/action-templates/actions/action-dependency-review/action.yml similarity index 100% rename from action-templates/actions/action-dependency-review/action-dependency-review.yml rename to action-templates/actions/action-dependency-review/action.yml From 442bb6d56a86719578c5a412b5fdbe5e2718dd58 Mon Sep 17 00:00:00 2001 From: Hans <11695964+hupling@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:23:13 +0100 Subject: [PATCH 4/7] Update action.yml --- action-templates/actions/action-dependency-review/action.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/action-templates/actions/action-dependency-review/action.yml b/action-templates/actions/action-dependency-review/action.yml index f147226..63d56ae 100644 --- a/action-templates/actions/action-dependency-review/action.yml +++ b/action-templates/actions/action-dependency-review/action.yml @@ -2,7 +2,6 @@ name: dependency-review runs: using: "composite" steps: - dependency-review: - name: Checkout code uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Dependency Review From 31f7b2c0abf9099b512770be27a4dab52732f645 Mon Sep 17 00:00:00 2001 From: Hans <11695964+hupling@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:25:59 +0100 Subject: [PATCH 5/7] Update actions.md --- docs/actions.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/actions.md b/docs/actions.md index 20ff1ec..fb83035 100644 --- a/docs/actions.md +++ b/docs/actions.md @@ -161,6 +161,10 @@ Executes the following steps: artifact-path: ./target/*.jar ``` +### action-dependecy-review + +The dependency review action scans your pull requests for dependency changes, and will raise an error if any vulnerabilities or invalid licenses are being introduced + ### action-deploy-docs Action to deploy a docs artifact to a web page. From f58b0e243305505d35a877848e905e7d2b3edb3d Mon Sep 17 00:00:00 2001 From: Hans <11695964+hupling@users.noreply.github.com> Date: Wed, 5 Mar 2025 13:28:59 +0100 Subject: [PATCH 6/7] Update action.yml --- .../actions/action-dependency-review/action.yml | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/action-templates/actions/action-dependency-review/action.yml b/action-templates/actions/action-dependency-review/action.yml index 63d56ae..10872e4 100644 --- a/action-templates/actions/action-dependency-review/action.yml +++ b/action-templates/actions/action-dependency-review/action.yml @@ -2,12 +2,9 @@ name: dependency-review runs: using: "composite" steps: - - name: Checkout code - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - name: Dependency Review - uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0 - with: - config-file: it-at-m/.github/workflow-configs/dependency_review.yaml@main - - - + - name: Checkout code + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: Dependency Review + uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0 + with: + config-file: it-at-m/.github/workflow-configs/dependency_review.yaml@main From 56b55ff5b74d6b4cb6ccd990a289d9513797dfcc Mon Sep 17 00:00:00 2001 From: Hans <11695964+hupling@users.noreply.github.com> Date: Wed, 5 Mar 2025 15:04:01 +0100 Subject: [PATCH 7/7] Update action.yml --- .../actions/action-dependency-review/action.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/action-templates/actions/action-dependency-review/action.yml b/action-templates/actions/action-dependency-review/action.yml index 10872e4..5b33ab8 100644 --- a/action-templates/actions/action-dependency-review/action.yml +++ b/action-templates/actions/action-dependency-review/action.yml @@ -1,4 +1,9 @@ name: dependency-review +inputs: + allow-dependencies-licenses: + default: "it-at-m/.github/workflow-configs/dependency_review.yaml@main" + type: string + description: A path to a file in the current repository or an external repository. runs: using: "composite" steps: @@ -7,4 +12,4 @@ runs: - name: Dependency Review uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0 with: - config-file: it-at-m/.github/workflow-configs/dependency_review.yaml@main + config-file: ${{ inputs.allow-dependencies-licenses }}