Skip to content

feat(security): enforce GitHub-hosted Ubuntu runner policy in CI (#2700) #4

feat(security): enforce GitHub-hosted Ubuntu runner policy in CI (#2700)

feat(security): enforce GitHub-hosted Ubuntu runner policy in CI (#2700) #4

# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
# SPDX-License-Identifier: MIT
name: Dependency Review
on:
push:
branches: [main, develop]
pull_request:
branches: [main, develop]
paths:
- "**/package.json"
- "**/package-lock.json"
- "**/pyproject.toml"
- "**/uv.lock"
- "**/requirements*.txt"
- ".github/workflows/dependency-review.yml"
workflow_call:
permissions:
contents: read
jobs:
dependency-review:
name: Review Dependencies
runs-on: ubuntu-latest
permissions:
contents: write # Elevated for Dependency Submission API (uv.lock)
pull-requests: write
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Submit uv.lock dependencies # Runs on push (base snapshots) and non-fork PRs
if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4
with:
detectorArgs: "UvLock=EnableIfDefaultOff"
- name: Dependency Review
if: github.event_name == 'pull_request'
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
with:
retry-on-snapshot-warnings: true
retry-on-snapshot-warnings-timeout: 120
fail-on-severity: moderate
# GHSA-69w3-r845-3855 (CVE-2026-1839): transformers Trainer
# arbitrary code execution via torch.load() without weights_only.
# The advisory states the issue only affects torch>=2.2 used with
# PyTorch < 2.6; the moderation eval pins torch==2.9.1 (>=2.6), so
# safe_globals() protection applies and the path is not exploitable.
# The only patched release (5.0.0rc3) is a pre-release that breaks
# detoxify==0.5.2, which requires transformers<5.
#
# GHSA-5p2g-fcmc-qvqq (CVE-2025-71329) and GHSA-w3rx-r6r6-pgpr:
# image-size infinite-loop denial of service in the JXL, HEIF, and
# ICNS parsers. Both advisories cover every published version
# (<= 2.0.2) and report no patched version, so no upgrade clears
# them. The package reaches this repository only as a transitive
# dependency of @docusaurus/mdx-loader, which measures repository
# controlled documentation images at site-build time. The
# attacker-supplied image buffer the advisories require is not
# reachable, and the site ships as static output with no runtime
# image parsing. Revisit when upstream publishes a fix.
allow-ghsas: >-
GHSA-69w3-r845-3855,
GHSA-5p2g-fcmc-qvqq,
GHSA-w3rx-r6r6-pgpr
comment-summary-in-pr: always
license-check: true
allow-licenses: >-
MIT, MIT-0, MIT-CMU, Apache-2.0,
BSD-2-Clause, BSD-3-Clause, ISC, 0BSD,
BlueOak-1.0.0, CC0-1.0, Unlicense,
CC-BY-4.0, CC-BY-3.0, PSF-2.0, Python-2.0,
HPND, LicenseRef-scancode-secret-labs-2011,
WTFPL, LicenseRef-scancode-unicode
# Packages with compound SPDX expressions containing GPL or MPL
# from bundled code; distributed licenses are permissive.
# @github/copilot and its platform-specific binaries (including
# @github/copilot-linuxmusl-arm64 and @github/copilot-linuxmusl-x64
# added in v1.0.63) use a non-SPDX proprietary license
# (LicenseRef-bad-see-license-in-license.md); it is GitHub's own
# CLI toolchain, pulled transitively via @github/copilot-sdk by the
# vally copilot-sdk executor used to run the eval suites.
# pkg:npm/hve-core is the private root package (never published to npm).
# pkg:pypi/certifi uses MPL-2.0 (Mozilla CA bundle).
# pkg:pypi/charset-normalizer is MIT licensed but some older wheel
# metadata declares a compound SPDX expression; the action treats
# compound expressions as a mismatch against allow-licenses.
# pkg:pypi/tqdm reports MIT AND MPL-2.0 in the submitted moderation
# graph; the action treats the compound expression as a mismatch.
# pkg:pypi/shapely declares a compound SPDX expression
# (BSD-3-Clause AND LGPL-2.1-only); shapely's distributed code is
# BSD-3-Clause and the LGPL component refers to bundled GEOS headers.
# The mural skill keyring/cryptography stack below ships permissive
# licenses (Apache-2.0, MIT, BSD-3-Clause, PSF-2.0) per each
# project's source repository, but PyPI metadata reports "unknown"
# so the action requires explicit allowlisting.
# pkg:npm/lightningcss (and its optional platform-specific binaries)
# is MPL-2.0 licensed; it is pulled in transitively by
# @docusaurus/faster's Rspack toolchain. MPL-2.0 is file-level
# copyleft and safe to consume as a dependency.
# pkg:npm/uri-js declares a compound SPDX expression
# (BSD-2-Clause AND BSD-2-Clause-Views); both components are
# permissive BSD variants, but the action treats the compound
# expression as a mismatch against allow-licenses.
# The pkg:pypi/torch ML stack below is the transitive dependency
# graph of the moderation eval (scripts/evals/moderation). torch
# resolves from the CPU-only wheel index
# (download.pytorch.org/whl/cpu), so the nvidia-*-cu12 CUDA runtime
# libraries are no longer pulled in. PyPI metadata reports
# "unknown" for the remaining packages so the action cannot match
# them against allow-licenses: torch is BSD-3-Clause; filelock is
# Unlicense (public domain); hf-xet, idna, and safetensors ship
# permissive licenses (Apache-2.0 / BSD-style) per their source
# repositories. pkg:pypi/regex declares a compound SPDX expression
# (CNRI-Python AND Apache-2.0) and is pulled transitively by
# transformers; CNRI-Python is a permissive PSF-style license. The
# moderation eval is an internal test harness, not a distributed
# product.
# The security-planning TM7 harness adds a Windows-only UI
# Automation group. Every package below ships a permissive license
# that already appears in allow-licenses; the action cannot match
# them because the dependency graph reports a compound expression or
# "unknown". Verified against the installed wheels:
# pkg:pypi/pywinauto declares a compound SPDX expression
# (BSD-3-Clause AND LGPL-2.1-only AND LGPL-2.1-or-later). The
# distributed wheel is BSD-3-Clause only: its METADATA declares
# "License: BSD 3-clause" with the OSI BSD classifier, its bundled
# LICENSE is the BSD 3-clause text, and the package contains no LGPL
# reference. The LGPL components are detected in the upstream source
# repository and are not redistributed in the wheel. This is the
# same situation as shapely above.
# pkg:pypi/comtypes is MIT (License-Expression: MIT).
# pkg:pypi/pillow is MIT-CMU (License-Expression: MIT-CMU).
# pkg:pypi/pywin32 is PSF (OSI Python Software Foundation License).
# The harness is Windows-only, opt-in, and not distributed as a
# product; portable TM7 generation requires none of these.
#
# axe-core and @axe-core/playwright are MPL-2.0, which is file-level
# copyleft rather than project-level. Both are already vendored at the
# same version by the Docusaurus site; the accessibility skill's
# runtime harness pins the same pair so probes resolve without a
# network fetch. They are development-time test tooling that is never
# linked into or redistributed with a shipped artifact, and no
# MPL-covered file is modified.
#
# pkg:npm/through2 resolves as the compound expression
# "MIT AND MITNFA", which the action cannot match against
# allow-licenses even though both halves are permissive; the package
# lockfile records plain MIT. It arrives transitively through regedit,
# which the accessibility harness uses to detect a local NVDA install.
# The nested scripts/extension/marketplace-publisher graph below is
# a manifest-scoped duplicate of the root @vscode/vsce 3.9.2
# build-time toolchain; every package resolves at the identical
# version already present in the root lockfile, but Dependency
# Review treats the new manifest as new dependencies.
# pkg:npm/binaryextensions, pkg:npm/editions,
# pkg:npm/istextorbinary, pkg:npm/textextensions, and
# pkg:npm/version-range are Artistic-2.0 build-time transitive
# dependencies of vsce. Artistic-2.0 is allowed only for these
# exact packages, not repository-wide.
# pkg:npm/typed-rest-client declares MIT in its own package
# metadata; the scanner's compound expression is metadata
# uncertainty, not a copyleft obligation.
# pkg:npm/hve-core-marketplace-publisher is the private nested
# root package (never published to npm) and is locally MIT.
# pkg:npm/%40vscode/vsce-sign is first-party Microsoft build-time
# publisher tooling under a non-SPDX reference ("SEE LICENSE IN
# LICENSE.txt") that resolves to the Microsoft Software License
# Terms published with the package at
# https://www.npmjs.com/package/@vscode/vsce-sign; those terms cover
# this build-time use, and the toolchain tarball is never shipped as
# a release asset.
# pkg:pypi/pyyaml is MIT licensed per its own source repository, but
# its PyPI metadata declares no SPDX expression, so the action cannot
# match it against allow-licenses. It is a direct dependency of the
# architecture-diagrams, ds-catalog, and ds-feasibility skills, which
# parse YAML through yaml.SafeLoader.
allow-dependencies-licenses: >-
pkg:pypi/lxml,
pkg:pypi/typing-extensions,
pkg:pypi/certifi,
pkg:pypi/charset-normalizer,
pkg:pypi/shapely,
pkg:pypi/backports-tarfile,
pkg:pypi/cryptography,
pkg:pypi/jaraco-classes,
pkg:pypi/jaraco-context,
pkg:pypi/jaraco-functools,
pkg:pypi/keyrings-alt,
pkg:pypi/torch,
pkg:pypi/filelock,
pkg:pypi/hf-xet,
pkg:pypi/idna,
pkg:pypi/safetensors,
pkg:pypi/regex,
pkg:pypi/tqdm,
pkg:pypi/pywinauto,
pkg:pypi/comtypes,
pkg:pypi/pillow,
pkg:pypi/pywin32,
pkg:pypi/pyyaml,
pkg:npm/dompurify,
pkg:npm/lunr-languages,
pkg:npm/%40github/copilot,
pkg:npm/%40github/copilot-darwin-arm64,
pkg:npm/%40github/copilot-darwin-x64,
pkg:npm/%40github/copilot-linux-arm64,
pkg:npm/%40github/copilot-linux-x64,
pkg:npm/%40github/copilot-win32-arm64,
pkg:npm/%40github/copilot-win32-x64,
pkg:npm/%40github/copilot-linuxmusl-arm64,
pkg:npm/%40github/copilot-linuxmusl-x64,
pkg:npm/lightningcss,
pkg:npm/lightningcss-android-arm64,
pkg:npm/lightningcss-darwin-arm64,
pkg:npm/lightningcss-darwin-x64,
pkg:npm/lightningcss-freebsd-x64,
pkg:npm/lightningcss-linux-arm-gnueabihf,
pkg:npm/lightningcss-linux-arm64-gnu,
pkg:npm/lightningcss-linux-arm64-musl,
pkg:npm/lightningcss-linux-x64-gnu,
pkg:npm/lightningcss-linux-x64-musl,
pkg:npm/lightningcss-win32-arm64-msvc,
pkg:npm/lightningcss-win32-x64-msvc,
pkg:npm/uri-js,
pkg:npm/axe-core,
pkg:npm/%40axe-core/playwright,
pkg:npm/through2,
pkg:npm/hve-core,
pkg:npm/hve-core-marketplace-publisher,
pkg:npm/%40vscode/vsce-sign,
pkg:npm/binaryextensions,
pkg:npm/editions,
pkg:npm/istextorbinary,
pkg:npm/textextensions,
pkg:npm/typed-rest-client,
pkg:npm/version-range
show-openssf-scorecard: true
warn-on-openssf-scorecard-level: 3