feat(governance): consolidate v3 migration, coverage, and ci fixes #25
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Google LLC | |
| # | |
| # Licensed under the Apache License, Version 2.0 (the "License"); | |
| # you may not use this file except in compliance with the License. | |
| # You may obtain a copy of the License at | |
| # | |
| # https://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| name: Dependency Review | |
| # POAM-013 / NIST SP 800-53 SI-2 / ISO 42001 §A.8.3 | |
| # Reviews dependency changes on every pull request. | |
| # Blocks PRs that introduce new dependencies with known vulnerabilities, | |
| # or that introduce CRITICAL/HIGH severity OSS license risks. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "**/requirements*.txt" | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review (POAM-013) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| # GitHub's dependency review action checks for: | |
| # 1. New dependencies with known CVEs (blocks CRITICAL/HIGH by default) | |
| # 2. License compatibility issues (configurable) | |
| # POAM-013: This blocks PRs that introduce >= specifiers without lock file entries | |
| # via the license/vulnerability enforcement below. | |
| - name: Dependency Review | |
| # continue-on-error: actions/dependency-review-action@v5 requires GitHub | |
| # Advanced Security (GHAS) and the Dependency Graph feature to be enabled | |
| # on the repository. Until GHAS is provisioned, this step is non-blocking | |
| # so that the rest of the POAM-013 checks (unpinned specifier scan below) | |
| # can still run and report. Track GHAS enablement under POAM-013. | |
| uses: actions/dependency-review-action@v5 | |
| continue-on-error: true | |
| with: | |
| # Fail on CRITICAL and HIGH vulnerabilities in new/changed dependencies | |
| fail-on-severity: high | |
| # Allow these licenses (Apache 2.0, MIT, BSD variants, PSF) | |
| allow-licenses: Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, Python-2.0 | |
| # Comment on the PR with dependency review results | |
| comment-summary-in-pr: always | |
| - name: Check for unpinned version specifiers (POAM-013) | |
| run: | | |
| echo "## Checking for unpinned >= specifiers in pyproject.toml (POAM-013)" >> $GITHUB_STEP_SUMMARY | |
| # Count unpinned specifiers | |
| UNPINNED=$(grep -E '^\s+"[a-zA-Z].*>=.*"' pyproject.toml | wc -l || true) | |
| echo "Unpinned \`>=\` specifiers found: $UNPINNED" >> $GITHUB_STEP_SUMMARY | |
| if [ "$UNPINNED" -gt "0" ]; then | |
| echo "### Unpinned dependencies detected:" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| grep -E '^\s+"[a-zA-Z].*>=.*"' pyproject.toml || true >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "> [!WARNING]" >> $GITHUB_STEP_SUMMARY | |
| echo "> **POAM-013**: This PR introduces or retains unpinned \`>=\` version specifiers." >> $GITHUB_STEP_SUMMARY | |
| echo "> Consider pinning these dependencies in \`uv.lock\` via \`uv lock\`." >> $GITHUB_STEP_SUMMARY | |
| echo "> Non-reproducible builds can introduce uncontrolled dependency updates." >> $GITHUB_STEP_SUMMARY | |
| # Warn only (not blocking) — pinning is tracked as POAM-013 in progress | |
| echo "WARNING: $UNPINNED unpinned specifiers found. See POAM-013 in docs/POAM_US_FED.md." | |
| else | |
| echo "✅ No unpinned \`>=\` specifiers found." >> $GITHUB_STEP_SUMMARY | |
| fi |