chore(security): harden GitHub workflows

2026-09-21 12:20:48 +02:00 · 2026-07-20 16:23:41 -07:00
parent 2e1e52eae7
commit 09492d34b4
8 changed files with 128 additions and 0 deletions
@@ -0,0 +1,21 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        with:
+          fail-on-severity: high