|
17 | 17 | - name: 'Checkout Repository' |
18 | 18 | uses: actions/checkout@v3 |
19 | 19 | - name: Dependency Review |
20 | | - uses: actions/dependency-review-action@v2 |
| 20 | + uses: actions/dependency-review-action@v3 |
21 | 21 | with: |
22 | | - # Possible values: "critical", "high", "moderate", "low" |
23 | | - # fail-on-severity: critical |
24 | | - |
25 | | - # You can only can only include one of these two options: `allow-licenses` and `deny-licences` |
26 | | - # ([String]). Only allow these licenses (optional) |
27 | | - # Possible values: Any `spdx_id` value(s) from https://docs.github.com/en/rest/licenses |
28 | | - # The following list is an attempt to match exactly what's listed on https://www.gnu.org/licenses/license-list.html#GPLCompatibleLicenses as GPL Compatible (currently ignoring the FSF Free/Libre and OSI Approved column data from the SPDX License List at https://spdx.org/licenses/): |
29 | | - allow-licenses: GPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0, LGPL-3.0-only, LGPL-2.1, LGPL-2.1-only, AGPL-3.0, AGPL-3.0-only, Apache-2.0, Artistic-2.0, Sleepycat, BSL-1.0, BSD-3-Clause, ECL-2.0, EFL-2.0, EUDatagrid, MIT, BSD-2-Clause, HPND, Intel, ISC, MPL-2.0, NCSA, UPL-1.0, Unlicense, W3C, Zlib, ZPL-2.0 |
30 | | - # The following licenses fit the above criteria except they are not marked as FSF Free/Libre on the SPDX License List (https://spdx.org/licenses/): Unicode-DFS-2016 |
31 | | - # The following licenses fit the above criteria except they are not marked as OSI Approved on the SPDX License List (https://spdx.org/licenses/): ClArtistic, CECILL-2.0, BSD-3-Clause-Clear, FTL, iMatix, Imlib2, IJG, OLDAP-2.7, Ruby, SGI-B-2.0, SMLNJ, Vim, WTFPL, X11, XFree86-1.1 |
32 | | - # ([String]). Block the pull request on these licenses (optional) |
33 | | - # Possible values: Any `spdx_id` value(s) from https://docs.github.com/en/rest/licenses |
34 | | - # The following list is an attempt to match exactly what's listed on https://www.gnu.org/licenses/license-list.html#GPLIncompatibleLicenses as GPL Incompatible: |
35 | | - # deny-licenses: AGPL-1.0, AGPL-1.0-only, AFL-1.1, AFL-1.2, AFL-2.0, AFL-2.1, AFL-3.0, Apache-1.1, Apache-1.0, APSL-2.0, BitTorrent-1.0, BSD-4-Clause, CECILL-B, CECILL-C, CDDL-1.0, CPAL-1.0, CPL-1.0, Condor-1.1, EPL-1.0, EPL-2.0, EUPL-1.1, EUPL-1.2, FDK-AAC, gnuplot, IPL-1.0, LPPL-1.3a, LPPL-1.2, LPL-1.02, MS-PL, MS-RL, MPL-1.1, NOSL, NPL-1.0, NPL-1.1, Nokia, OLDAP-2.3, OSL-1.0, OSL-1.1, OSL-2.0, OSL-2.1, OSL-3.0, OpenSSL, PHP-3.01, Python-2.0, QPL-1.0, RPSL-1.0, SISSL, SPL-1.0, xinetd, YPL-1.1, Zend-2.0, Zimbra-1.3, ZPL-1.1 |
36 | | - # The following list is an attempt, additionally, to match exactly what's listedn on https://www.gnu.org/licenses/license-list.html#NonFreeSoftwareLicenses as Nonfree: Aladdin, APSL-1.0, APSL-1.1, APSL-1.2, Artistic-1.0, CPOL-1.02, RHeCos-1.1, JSON, NASA-1.3, OPL-1.0, RPL-1.1, Watcom-1.0 |
| 22 | + license-check: true |
| 23 | + vulnerability-check: false |
| 24 | + config-file: 10up/.github/.github/dependency-review-config.yml@trunk |
0 commit comments