ci: add 14 OSS-standard GitHub workflows (valkey reference parity) #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency review | |
| # Block PRs that introduce dependencies with known CVEs, unacceptable | |
| # licenses, or unverified provenance. Pairs with govulncheck (which | |
| # scans only what the binary calls) — dependency-review covers the | |
| # graph of every PR addition, not just reachable code. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| review: | |
| name: Review dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write # comment the diff summary inline | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4 | |
| with: | |
| fail-on-severity: high | |
| # See https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-review-action | |
| # The repo is Apache-2.0; accept compatible permissive licenses | |
| # explicitly. Reject GPL-family (copyleft) to keep the binary | |
| # safe to redistribute as a closed-source operator image. | |
| allow-licenses: Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, Zlib, Unlicense, 0BSD, CC0-1.0 | |
| comment-summary-in-pr: on-failure |