dependency-review.yaml

name: "Dependency Review"

on:
  pull_request_target:
    types: [ "opened", "synchronize", "edited", "reopened" ]
    paths:
      - "*"
      - ".github/**"
  push:
    branches:
      - "**"
    paths:
      - "*"
      - ".github/**"

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

permissions:
  contents: "read"
  pull-requests: "write"

jobs:
  dependency-review:
    name: "Dependency Review"
    runs-on: "ubuntu-latest"

    steps:
      - name: "Checkout"
        uses: "actions/checkout@v4"

      - name: "Dependency Review"
        uses: "actions/dependency-review-action@v4"
        with:
          base-ref: "${{ github.event_name == 'push' && github.event.before || '' }}"
          head-ref: "${{ github.event_name == 'push' && github.sha || '' }}"
          comment-summary-in-pr: "always"
          fail-on-severity: "high"
          show-openssf-scorecard: false