Skip to content

Dependency Review Scanner

Dependency Review Scanner - Reusable Workflow

NOTE: Dependency Review uses GitHub-native actions (actions/dependency-review-action) which argus cannot replace. This workflow keeps the composite action call until argus supports dependency review natively.

NOTE: This scanner only works on pull_request events. On other event types it will skip gracefully with a warning annotation and zero-count summary.

For GHES users: Use the composite action directly instead of this workflow.

uses: huntridge-labs/argus/.github/workflows/scanner-dependency-review.yml@1.12.2

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
security-events write
actions read
pull-requests write

Inputs

Input Description Required Default
allow_failure When true (default) the scan never fails the job (non-blocking); when false, a scan crash or a fail_on_severity breac... boolean No True
post_pr_comment Whether to post PR comments boolean No True
enable_code_security Whether GitHub Code Security is enabled for this repository boolean No False
fail_on_severity Fail if findings at or above this severity. Options: none, low, medium, high, critical. string No none
vulnerability_check Enable vulnerability checking boolean No True
license_check Enable license compliance checking boolean No False
allow_licenses Comma-separated SPDX license identifiers to allow string No —
deny_licenses Comma-separated SPDX license identifiers to deny string No —

Jobs

dependency-review — Dependency Review

Runs on: ubuntu-latest · Timeout: 15 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
  2. Run Dependency Review Scanner — huntridge-labs/argus/.github/actions/scanner-dependency-review@1.12.2

Actions used:

All Composite Actions Referenced