ci(deps): bump astral-sh/setup-uv from c0c76fcf76c37099e6a452584d04b015240faefc to 88aa608651c03dd9c5c3132acb9f2da90b3e6e15 #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| permissions: | |
| contents: read | |
| # Write permission for security-events is required for private repositories | |
| # to upload SARIF files. For public repositories, this permission is not needed. | |
| security-events: write | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| with: | |
| # Fail the build if vulnerabilities are found | |
| fail-on-severity: moderate | |
| # Deny copyleft and non-permissive licenses explicitly | |
| deny-licenses: AGPL-3.0, GPL-2.0-only, GPL-3.0-only, LGPL-2.0-only, LGPL-2.1-only, LGPL-3.0-only, SSPL-1.0, BUSL-1.1 | |
| # Create a summary comment on the PR | |
| comment-summary-in-pr: true | |
| # Additional security scanning for Python dependencies | |
| python-security: | |
| name: Python Dependency Security | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.1 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@88aa608651c03dd9c5c3132acb9f2da90b3e6e15 # v4.0.0 | |
| - name: Set up Python | |
| run: uv python install 3.13 | |
| - name: Install dependencies | |
| run: uv sync --locked --dev | |
| - name: Run safety check | |
| run: | | |
| # Install safety for vulnerability scanning | |
| uv add --dev safety | |
| uv run safety check --json --output safety-report.json | |
| continue-on-error: true | |
| - name: Upload safety report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: always() | |
| with: | |
| name: safety-security-report | |
| path: safety-report.json | |
| - name: Security Summary | |
| if: always() | |
| run: | | |
| echo "## 🔒 Dependency Security Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [ -f "safety-report.json" ]; then | |
| echo "### Safety Vulnerability Scan" >> $GITHUB_STEP_SUMMARY | |
| echo "Detailed report uploaded as artifact." >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "### ✅ Safety Vulnerability Scan" >> $GITHUB_STEP_SUMMARY | |
| echo "No known vulnerabilities found in dependencies." >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Dependency Review Features" >> $GITHUB_STEP_SUMMARY | |
| echo "- ✅ License compliance checking" >> $GITHUB_STEP_SUMMARY | |
| echo "- ✅ Vulnerability severity: moderate+" >> $GITHUB_STEP_SUMMARY | |
| echo "- ✅ Automatic PR comments enabled" >> $GITHUB_STEP_SUMMARY |