1  # Dependency Review Action
 2  #
 3  # This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
 4  #
 5  # Source repository: https://github.com/actions/dependency-review-action
 6  # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 7  name: 'Dependency Review'
 8  on: [pull_request]
 9  
10  permissions:
11    contents: read
12  
13  jobs:
14    dependency-review:
15      runs-on: ubuntu-latest
16      steps:
17        - name: 'Checkout Repository'
18          uses: actions/checkout@v3
19        - name: 'Dependency Review'
20          uses: actions/dependency-review-action@v2
21          with:
22            fail-on-severity: critical