Bump the dotnet group with 30 updates #141
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency review | |
| # On every PR, flag dependencies that introduce known vulnerabilities or disallowed licenses | |
| # (reads the GitHub dependency graph — covers both NuGet and npm). No deployment. | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-review: | |
| name: Review | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # Findings land in the job summary + the check. We don't post a PR comment: on Dependabot | |
| # PRs the GITHUB_TOKEN is read-only, so commenting would just fail there. | |
| # NOTE: requires "Dependency graph" enabled in repo Settings → Code security. | |
| - name: Dependency review | |
| uses: actions/dependency-review-action@v5 | |
| with: | |
| fail-on-severity: high |