Skip to content

Commit 272b9b4

Browse files
[EDI] Configuring the dependency review action (#59806)
Co-authored-by: Joe Clark <31087804+jc-clark@users.noreply.github.com>
1 parent d8983c4 commit 272b9b4

File tree

1 file changed

+3
-30
lines changed

1 file changed

+3
-30
lines changed

content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-the-dependency-review-action.md

Lines changed: 3 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,36 +19,10 @@ redirect_from:
1919
contentType: how-tos
2020
---
2121

22-
## About the {% data variables.dependency-review.action_name %}
23-
24-
The "{% data variables.dependency-review.action_name %}" refers to the specific action that can report on differences in a pull request within the {% data variables.product.prodname_actions %} context, and add enforcement mechanisms to the {% data variables.product.prodname_actions %} workflow.
25-
26-
{% data reusables.dependency-review.dependency-review-action-overview %}
27-
28-
{% data reusables.dependency-review.org-level-enforcement %}
29-
30-
Here is a list of common configuration options. For more information, and a full list of options, see [Dependency Review](https://github.com/marketplace/actions/dependency-review) on the {% data variables.product.prodname_marketplace %}.
31-
32-
| Option | Required | Usage |
33-
|------------------|-------------------------------|--------|
34-
| `fail-on-severity` | {% octicon "x" aria-label="Optional" %} | Defines the threshold for level of severity (`low`, `moderate`, `high`, `critical`).</br>The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. |
35-
| {% ifversion dependency-review-action-licenses %} |
36-
| `allow-licenses` | {% octicon "x" aria-label="Optional" %} | Contains a list of allowed licenses. You can find the possible values for this parameter in the [Licenses](/rest/licenses) page of the API documentation.</br>The action will fail on pull requests that introduce dependencies with licenses that do not match the list.|
37-
| {% endif %} |
38-
| {% ifversion dependency-review-action-licenses %} |
39-
| `deny-licenses` | {% octicon "x" aria-label="Optional" %} | Contains a list of prohibited licenses. You can find the possible values for this parameter in the [Licenses](/rest/licenses) page of the API documentation.</br>The action will fail on pull requests that introduce dependencies with licenses that match the list.|
40-
| {% endif %} |
41-
| `fail-on-scopes` | {% octicon "x" aria-label="Optional" %} | Contains a list of strings representing the build environments you want to support (`development`, `runtime`, `unknown`). </br>The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list.|
42-
| `comment-summary-in-pr` | {% octicon "x" aria-label="Optional" %} | Enable or disable the reporting of the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission. With each execution, a new comment will overwrite the existing one.|
43-
| `allow-ghsas` | {% octicon "x" aria-label="Optional" %} | Contains a list of {% data variables.product.prodname_advisory_database %} IDs that can be skipped during detection. You can find the possible values for this parameter in the [{% data variables.product.prodname_advisory_database %}](https://github.com/advisories). |
44-
| `config-file` | {% octicon "x" aria-label="Optional" %} | Specifies a path to a configuration file. The configuration file can be local to the repository or a file located in an external repository.|
45-
| `external-repo-token` | {% octicon "x" aria-label="Optional" %} | Specifies a token for fetching the configuration file, if the file resides in a private external repository. The token must have read access to the repository.|
46-
47-
{% ifversion dependency-review-action-licenses %}
48-
49-
> [!TIP]
50-
> The `allow-licenses` and `deny-licenses` options are mutually exclusive.
22+
The "{% data variables.dependency-review.action_name %}" refers to the specific action that can report on differences in a pull request within the {% data variables.product.prodname_actions %} context. It can also add enforcement mechanisms to the {% data variables.product.prodname_actions %} workflow. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/about-dependency-review#about-the-dependency-review-action).
5123

24+
For a list of common configuration options, see [Dependency review](https://github.com/marketplace/actions/dependency-review#configuration-options) on the {% data variables.product.prodname_marketplace %}.
25+
5226
## Configuring the {% data variables.dependency-review.action_name %}
5327

5428
There are two methods of configuring the {% data variables.dependency-review.action_name %}:
@@ -195,7 +169,6 @@ Notice that all of the examples use a short version number for the action (`v3`)
195169
<!-- markdownlint-enable search-replace -->
196170
197171
For further details about the configuration options, see [`dependency-review-action`](https://github.com/actions/dependency-review-action#readme).
198-
{% endif %}
199172

200173
## Further reading
201174

0 commit comments

Comments
 (0)