Skip to content

Dependency Review Scanner

Dependency Review Scanner - Reusable Workflow

NOTE: Dependency Review uses GitHub-native actions (actions/dependency-review-action) which argus cannot replace. This workflow keeps the composite action call until argus supports dependency review natively.

NOTE: This scanner only works on pull_request events. On other event types it will skip gracefully with a warning annotation and zero-count summary.

For GHES users: Use the composite action directly instead of this workflow.

uses: huntridge-labs/argus/.github/workflows/scanner-dependency-review.yml@1.1.0

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
security-events write
actions read
pull-requests write

Inputs

Input Description Required Default
post_pr_comment Whether to post PR comments boolean No True
enable_code_security Whether GitHub Code Security is enabled for this repository boolean No False
fail_on_severity Fail if findings at or above this severity. Options: none, low, medium, high, critical. string No none
vulnerability_check Enable vulnerability checking boolean No True
license_check Enable license compliance checking boolean No False
allow_licenses Comma-separated SPDX license identifiers to allow string No —
deny_licenses Comma-separated SPDX license identifiers to deny string No —

Jobs

dependency-review — Dependency Review

Runs on: ubuntu-latest · Timeout: 15 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Run Dependency Review Scanner — huntridge-labs/argus/.github/actions/scanner-dependency-review@1.1.0

Actions used:

All Composite Actions Referenced