Create dependency-review.yml

[joeyyy09]

This change addresses the issue reported in Issue #33.

Changes Made

• Added a new GitHub Actions workflow file (dependency-review.yml) to the .github/workflows directory.
• Configured the workflow to run the Dependency Review Action on every pull request.
• Configured permissions required by the action.
• Specified job to run on the ubuntu-latest environment.
• Configured the Dependency Review Action to:
  • Post a summary comment in the pull request.
  • Fail the CI if vulnerabilities with a severity of "high" are found.
  • Specify allowed licenses.
  • Specify which dependency scopes should cause the CI to fail if vulnerabilities are found.
  • Allow specific licenses for certain dependencies.

[magner669]

Would you be willing to take the issue this is referring to? I think if you commment on it I can assign it to you.

[joeyyy09]

Yeah, can you walk me through what else I've got to do?

[magner669]

@joeyyy09 Please click #33 and write comment for starters.
This PR is now approved but can't be merged becuse the CodeQL check hasn't completed yet. @JamieSlome any clue?

[joeyyy09]

Yeah, the CodeQL check is still waiting for status, anything to be done from my end?

[magner669]

I'd wait for @JamieSlome to let us known if he has a clue.

I did a bit of research on Google, and found:

https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks

https://stackoverflow.com/questions/52200096/github-pull-request-waiting-for-status-to-be-reported

[magner669]

Some of the worflows require a maintainer to run., which is surprising to me and might be a valuable clue.

I allowed some of the m to run, however it didn't clear up the CodeQl check which is still "Expected".

https://github.com/Citi/gradle-helm-plugin/actions/runs/8629901325

[joeyyy09]

Hey, I've been trying to find out why the CodeQl check is still in the waiting stage, I think this is might help. Idts it has anything to do with the code but something to do with the github actions itself.
https://github.com/orgs/community/discussions/26698

[JamieSlome]

I believe the CodeQL check runs periodically instead of on the pull request event.

I will open a PR to implement the CodeQL workflow 💪

[JamieSlome]

@magner669 - I've removed the CodeQL status check requirement. We can address the CodeQL runner in #36.