ci(deps): bump astral-sh/setup-uv from cdfb2ee6dde255817c739680168ad81e184c4bfb to 05143d3dcd540a42aa638bb0920ac4e3123808a5 #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| permissions: | |
| contents: read | |
| # Write permission for security-events is required for private repositories | |
| # to upload SARIF files. For public repositories, this permission is not needed. | |
| security-events: write | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.1 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| with: | |
| # Fail the build if vulnerabilities are found | |
| fail-on-severity: moderate | |
| # Deny copyleft and non-permissive licenses explicitly | |
| deny-licenses: AGPL-3.0, GPL-2.0-only, GPL-3.0-only, LGPL-2.0-only, LGPL-2.1-only, LGPL-3.0-only, SSPL-1.0, BUSL-1.1 | |
| # Create a summary comment on the PR | |
| comment-summary-in-pr: true | |
| # Additional security scanning for Python dependencies | |
| python-security: | |
| name: Python Dependency Security | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.1 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@05143d3dcd540a42aa638bb0920ac4e3123808a5 # v4.0.0 | |
| - name: Set up Python | |
| run: uv python install 3.13 | |
| - name: Install dependencies | |
| run: uv sync --locked --dev | |
| - name: Run safety check | |
| run: | | |
| # Install safety for vulnerability scanning | |
| uv add --dev safety | |
| uv run safety check --json --output safety-report.json | |
| continue-on-error: true | |
| - name: Upload safety report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: always() | |
| with: | |
| name: safety-security-report | |
| path: safety-report.json | |
| - name: Security Summary | |
| if: always() | |
| run: | | |
| echo "## 🔒 Dependency Security Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [ -f "safety-report.json" ]; then | |
| echo "### Safety Vulnerability Scan" >> $GITHUB_STEP_SUMMARY | |
| echo "Detailed report uploaded as artifact." >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "### ✅ Safety Vulnerability Scan" >> $GITHUB_STEP_SUMMARY | |
| echo "No known vulnerabilities found in dependencies." >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Dependency Review Features" >> $GITHUB_STEP_SUMMARY | |
| echo "- ✅ License compliance checking" >> $GITHUB_STEP_SUMMARY | |
| echo "- ✅ Vulnerability severity: moderate+" >> $GITHUB_STEP_SUMMARY | |
| echo "- ✅ Automatic PR comments enabled" >> $GITHUB_STEP_SUMMARY |