You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-the-dependency-review-action.md
+3-30Lines changed: 3 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,36 +19,10 @@ redirect_from:
19
19
contentType: how-tos
20
20
---
21
21
22
-
## About the {% data variables.dependency-review.action_name %}
23
-
24
-
The "{% data variables.dependency-review.action_name %}" refers to the specific action that can report on differences in a pull request within the {% data variables.product.prodname_actions %} context, and add enforcement mechanisms to the {% data variables.product.prodname_actions %} workflow.
25
-
26
-
{% data reusables.dependency-review.dependency-review-action-overview %}
27
-
28
-
{% data reusables.dependency-review.org-level-enforcement %}
29
-
30
-
Here is a list of common configuration options. For more information, and a full list of options, see [Dependency Review](https://github.com/marketplace/actions/dependency-review) on the {% data variables.product.prodname_marketplace %}.
|`fail-on-severity`| {% octicon "x" aria-label="Optional" %} | Defines the threshold for level of severity (`low`, `moderate`, `high`, `critical`).</br>The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher. |
|`allow-licenses`| {% octicon "x" aria-label="Optional" %} | Contains a list of allowed licenses. You can find the possible values for this parameter in the [Licenses](/rest/licenses) page of the API documentation.</br>The action will fail on pull requests that introduce dependencies with licenses that do not match the list.|
|`deny-licenses`| {% octicon "x" aria-label="Optional" %} | Contains a list of prohibited licenses. You can find the possible values for this parameter in the [Licenses](/rest/licenses) page of the API documentation.</br>The action will fail on pull requests that introduce dependencies with licenses that match the list.|
40
-
| {% endif %} |
41
-
|`fail-on-scopes`| {% octicon "x" aria-label="Optional" %} | Contains a list of strings representing the build environments you want to support (`development`, `runtime`, `unknown`). </br>The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list.|
42
-
|`comment-summary-in-pr`| {% octicon "x" aria-label="Optional" %} | Enable or disable the reporting of the review summary as a comment in the pull request. If enabled, you must give the workflow or job the `pull-requests: write` permission. With each execution, a new comment will overwrite the existing one.|
43
-
|`allow-ghsas`| {% octicon "x" aria-label="Optional" %} | Contains a list of {% data variables.product.prodname_advisory_database %} IDs that can be skipped during detection. You can find the possible values for this parameter in the [{% data variables.product.prodname_advisory_database %}](https://github.com/advisories). |
44
-
|`config-file`| {% octicon "x" aria-label="Optional" %} | Specifies a path to a configuration file. The configuration file can be local to the repository or a file located in an external repository.|
45
-
|`external-repo-token`| {% octicon "x" aria-label="Optional" %} | Specifies a token for fetching the configuration file, if the file resides in a private external repository. The token must have read access to the repository.|
46
-
47
-
{% ifversion dependency-review-action-licenses %}
48
-
49
-
> [!TIP]
50
-
> The `allow-licenses` and `deny-licenses` options are mutually exclusive.
22
+
The "{% data variables.dependency-review.action_name %}" refers to the specific action that can report on differences in a pull request within the {% data variables.product.prodname_actions %} context. It can also add enforcement mechanisms to the {% data variables.product.prodname_actions %} workflow. For more information, see [AUTOTITLE](/code-security/concepts/supply-chain-security/about-dependency-review#about-the-dependency-review-action).
51
23
24
+
For a list of common configuration options, see [Dependency review](https://github.com/marketplace/actions/dependency-review#configuration-options) on the {% data variables.product.prodname_marketplace %}.
25
+
52
26
## Configuring the {% data variables.dependency-review.action_name %}
53
27
54
28
There are two methods of configuring the {% data variables.dependency-review.action_name %}:
@@ -195,7 +169,6 @@ Notice that all of the examples use a short version number for the action (`v3`)
195
169
<!-- markdownlint-enable search-replace -->
196
170
197
171
For further details about the configuration options, see [`dependency-review-action`](https://github.com/actions/dependency-review-action#readme).
0 commit comments