dependency-review.yml

# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
# SPDX-License-Identifier: MIT
name: Dependency Review

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
    paths:
      - "**/package.json"
      - "**/package-lock.json"
      - "**/pyproject.toml"
      - "**/uv.lock"
      - "**/requirements*.txt"
      - ".github/workflows/dependency-review.yml"
  workflow_call:

permissions:
  contents: read

jobs:
  dependency-review:
    name: Review Dependencies
    runs-on: ubuntu-latest
    permissions:
      contents: write # Elevated for Dependency Submission API (uv.lock)
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Submit uv.lock dependencies # Runs on push (base snapshots) and non-fork PRs
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4
        with:
          detectorArgs: "UvLock=EnableIfDefaultOff"

      - name: Dependency Review
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          retry-on-snapshot-warnings: true
          retry-on-snapshot-warnings-timeout: 120
          fail-on-severity: moderate
          # GHSA-69w3-r845-3855 (CVE-2026-1839): transformers Trainer
          # arbitrary code execution via torch.load() without weights_only.
          # The advisory states the issue only affects torch>=2.2 used with
          # PyTorch < 2.6; the moderation eval pins torch==2.9.1 (>=2.6), so
          # safe_globals() protection applies and the path is not exploitable.
          # The only patched release (5.0.0rc3) is a pre-release that breaks
          # detoxify==0.5.2, which requires transformers<5.
          #
          # GHSA-5p2g-fcmc-qvqq (CVE-2025-71329) and GHSA-w3rx-r6r6-pgpr:
          # image-size infinite-loop denial of service in the JXL, HEIF, and
          # ICNS parsers. Both advisories cover every published version
          # (<= 2.0.2) and report no patched version, so no upgrade clears
          # them. The package reaches this repository only as a transitive
          # dependency of @docusaurus/mdx-loader, which measures repository
          # controlled documentation images at site-build time. The
          # attacker-supplied image buffer the advisories require is not
          # reachable, and the site ships as static output with no runtime
          # image parsing. Revisit when upstream publishes a fix.
          allow-ghsas: >-
            GHSA-69w3-r845-3855,
            GHSA-5p2g-fcmc-qvqq,
            GHSA-w3rx-r6r6-pgpr
          comment-summary-in-pr: always
          license-check: true
          allow-licenses: >-
            MIT, MIT-0, MIT-CMU, Apache-2.0,
            BSD-2-Clause, BSD-3-Clause, ISC, 0BSD,
            BlueOak-1.0.0, CC0-1.0, Unlicense,
            CC-BY-4.0, CC-BY-3.0, PSF-2.0, Python-2.0,
            HPND, LicenseRef-scancode-secret-labs-2011,
            WTFPL, LicenseRef-scancode-unicode
          # Packages with compound SPDX expressions containing GPL or MPL
          # from bundled code; distributed licenses are permissive.
          # @github/copilot and its platform-specific binaries (including
          # @github/copilot-linuxmusl-arm64 and @github/copilot-linuxmusl-x64
          # added in v1.0.63) use a non-SPDX proprietary license
          # (LicenseRef-bad-see-license-in-license.md); it is GitHub's own
          # CLI toolchain, pulled transitively via @github/copilot-sdk by the
          # vally copilot-sdk executor used to run the eval suites.
          # pkg:npm/hve-core is the private root package (never published to npm).
          # pkg:pypi/certifi uses MPL-2.0 (Mozilla CA bundle).
          # pkg:pypi/charset-normalizer is MIT licensed but some older wheel
          # metadata declares a compound SPDX expression; the action treats
          # compound expressions as a mismatch against allow-licenses.
          # pkg:pypi/tqdm reports MIT AND MPL-2.0 in the submitted moderation
          # graph; the action treats the compound expression as a mismatch.
          # pkg:pypi/shapely declares a compound SPDX expression
          # (BSD-3-Clause AND LGPL-2.1-only); shapely's distributed code is
          # BSD-3-Clause and the LGPL component refers to bundled GEOS headers.
          # The mural skill keyring/cryptography stack below ships permissive
          # licenses (Apache-2.0, MIT, BSD-3-Clause, PSF-2.0) per each
          # project's source repository, but PyPI metadata reports "unknown"
          # so the action requires explicit allowlisting.
          # pkg:npm/lightningcss (and its optional platform-specific binaries)
          # is MPL-2.0 licensed; it is pulled in transitively by
          # @docusaurus/faster's Rspack toolchain. MPL-2.0 is file-level
          # copyleft and safe to consume as a dependency.
          # pkg:npm/uri-js declares a compound SPDX expression
          # (BSD-2-Clause AND BSD-2-Clause-Views); both components are
          # permissive BSD variants, but the action treats the compound
          # expression as a mismatch against allow-licenses.
          # The pkg:pypi/torch ML stack below is the transitive dependency
          # graph of the moderation eval (scripts/evals/moderation). torch
          # resolves from the CPU-only wheel index
          # (download.pytorch.org/whl/cpu), so the nvidia-*-cu12 CUDA runtime
          # libraries are no longer pulled in. PyPI metadata reports
          # "unknown" for the remaining packages so the action cannot match
          # them against allow-licenses: torch is BSD-3-Clause; filelock is
          # Unlicense (public domain); hf-xet, idna, and safetensors ship
          # permissive licenses (Apache-2.0 / BSD-style) per their source
          # repositories. pkg:pypi/regex declares a compound SPDX expression
          # (CNRI-Python AND Apache-2.0) and is pulled transitively by
          # transformers; CNRI-Python is a permissive PSF-style license. The
          # moderation eval is an internal test harness, not a distributed
          # product.
          # The security-planning TM7 harness adds a Windows-only UI
          # Automation group. Every package below ships a permissive license
          # that already appears in allow-licenses; the action cannot match
          # them because the dependency graph reports a compound expression or
          # "unknown". Verified against the installed wheels:
          # pkg:pypi/pywinauto declares a compound SPDX expression
          # (BSD-3-Clause AND LGPL-2.1-only AND LGPL-2.1-or-later). The
          # distributed wheel is BSD-3-Clause only: its METADATA declares
          # "License: BSD 3-clause" with the OSI BSD classifier, its bundled
          # LICENSE is the BSD 3-clause text, and the package contains no LGPL
          # reference. The LGPL components are detected in the upstream source
          # repository and are not redistributed in the wheel. This is the
          # same situation as shapely above.
          # pkg:pypi/comtypes is MIT (License-Expression: MIT).
          # pkg:pypi/pillow is MIT-CMU (License-Expression: MIT-CMU).
          # pkg:pypi/pywin32 is PSF (OSI Python Software Foundation License).
          # The harness is Windows-only, opt-in, and not distributed as a
          # product; portable TM7 generation requires none of these.
          #
          # axe-core and @axe-core/playwright are MPL-2.0, which is file-level
          # copyleft rather than project-level. Both are already vendored at the
          # same version by the Docusaurus site; the accessibility skill's
          # runtime harness pins the same pair so probes resolve without a
          # network fetch. They are development-time test tooling that is never
          # linked into or redistributed with a shipped artifact, and no
          # MPL-covered file is modified.
          #
          # pkg:npm/through2 resolves as the compound expression
          # "MIT AND MITNFA", which the action cannot match against
          # allow-licenses even though both halves are permissive; the package
          # lockfile records plain MIT. It arrives transitively through regedit,
          # which the accessibility harness uses to detect a local NVDA install.
          # The nested scripts/extension/marketplace-publisher graph below is
          # a manifest-scoped duplicate of the root @vscode/vsce 3.9.2
          # build-time toolchain; every package resolves at the identical
          # version already present in the root lockfile, but Dependency
          # Review treats the new manifest as new dependencies.
          # pkg:npm/binaryextensions, pkg:npm/editions,
          # pkg:npm/istextorbinary, pkg:npm/textextensions, and
          # pkg:npm/version-range are Artistic-2.0 build-time transitive
          # dependencies of vsce. Artistic-2.0 is allowed only for these
          # exact packages, not repository-wide.
          # pkg:npm/typed-rest-client declares MIT in its own package
          # metadata; the scanner's compound expression is metadata
          # uncertainty, not a copyleft obligation.
          # pkg:npm/hve-core-marketplace-publisher is the private nested
          # root package (never published to npm) and is locally MIT.
          # pkg:npm/%40vscode/vsce-sign is first-party Microsoft build-time
          # publisher tooling under a non-SPDX reference ("SEE LICENSE IN
          # LICENSE.txt") that resolves to the Microsoft Software License
          # Terms published with the package at
          # https://www.npmjs.com/package/@vscode/vsce-sign; those terms cover
          # this build-time use, and the toolchain tarball is never shipped as
          # a release asset.
          # pkg:pypi/pyyaml is MIT licensed per its own source repository, but
          # its PyPI metadata declares no SPDX expression, so the action cannot
          # match it against allow-licenses. It is a direct dependency of the
          # architecture-diagrams, ds-catalog, and ds-feasibility skills, which
          # parse YAML through yaml.SafeLoader.
          allow-dependencies-licenses: >-
            pkg:pypi/lxml,
            pkg:pypi/typing-extensions,
            pkg:pypi/certifi,
            pkg:pypi/charset-normalizer,
            pkg:pypi/shapely,
            pkg:pypi/backports-tarfile,
            pkg:pypi/cryptography,
            pkg:pypi/jaraco-classes,
            pkg:pypi/jaraco-context,
            pkg:pypi/jaraco-functools,
            pkg:pypi/keyrings-alt,
            pkg:pypi/torch,
            pkg:pypi/filelock,
            pkg:pypi/hf-xet,
            pkg:pypi/idna,
            pkg:pypi/safetensors,
            pkg:pypi/regex,
            pkg:pypi/tqdm,
            pkg:pypi/pywinauto,
            pkg:pypi/comtypes,
            pkg:pypi/pillow,
            pkg:pypi/pywin32,
            pkg:pypi/pyyaml,
            pkg:npm/dompurify,
            pkg:npm/lunr-languages,
            pkg:npm/%40github/copilot,
            pkg:npm/%40github/copilot-darwin-arm64,
            pkg:npm/%40github/copilot-darwin-x64,
            pkg:npm/%40github/copilot-linux-arm64,
            pkg:npm/%40github/copilot-linux-x64,
            pkg:npm/%40github/copilot-win32-arm64,
            pkg:npm/%40github/copilot-win32-x64,
            pkg:npm/%40github/copilot-linuxmusl-arm64,
            pkg:npm/%40github/copilot-linuxmusl-x64,
            pkg:npm/lightningcss,
            pkg:npm/lightningcss-android-arm64,
            pkg:npm/lightningcss-darwin-arm64,
            pkg:npm/lightningcss-darwin-x64,
            pkg:npm/lightningcss-freebsd-x64,
            pkg:npm/lightningcss-linux-arm-gnueabihf,
            pkg:npm/lightningcss-linux-arm64-gnu,
            pkg:npm/lightningcss-linux-arm64-musl,
            pkg:npm/lightningcss-linux-x64-gnu,
            pkg:npm/lightningcss-linux-x64-musl,
            pkg:npm/lightningcss-win32-arm64-msvc,
            pkg:npm/lightningcss-win32-x64-msvc,
            pkg:npm/uri-js,
            pkg:npm/axe-core,
            pkg:npm/%40axe-core/playwright,
            pkg:npm/through2,
            pkg:npm/hve-core,
            pkg:npm/hve-core-marketplace-publisher,
            pkg:npm/%40vscode/vsce-sign,
            pkg:npm/binaryextensions,
            pkg:npm/editions,
            pkg:npm/istextorbinary,
            pkg:npm/textextensions,
            pkg:npm/typed-rest-client,
            pkg:npm/version-range
          show-openssf-scorecard: true
          warn-on-openssf-scorecard-level: 3