Configuring the dependency review action

About the Abhängigkeitsüberprüfungsaktion

The "Abhängigkeitsüberprüfungsaktion" refers to the specific action that can report on differences in a pull request within the GitHub Actions context, and add enforcement mechanisms to the GitHub Actions workflow.

Die Abhängigkeitsüberprüfungsaktion prüft deine Pull Requests auf Änderungen bei Abhängigkeiten und gibt einen Fehler aus, wenn neue Abhängigkeiten bekannte Sicherheitsrisiken aufweisen. Die Aktion wird von einem API-Endpunkt unterstützt, der die Abhängigkeiten zwischen zwei Revisionen vergleicht und etwaige Unterschiede meldet.

Weitere Informationen zur Aktion und zum API-Endpunkt finden Sie in der Dokumentation dependency-review-action und unter „REST-API-Endpunkte für die Abhängigkeitsüberprüfung“.

Organisationsbesitzer*innen können die Abhängigkeitsüberprüfung im großen Stil einführen, indem sie die Nutzung der Abhängigkeitsüberprüfungsaktion für Repositorys in der Organisation erzwingen. Dies umfasst die Nutzung von Repository-Regelsätzen, für die Sie die Abhängigkeitsüberprüfungsaktion als erforderlichen Workflow festlegen. Das bedeutet, dass Pull Requests nur zusammengeführt werden können, nachdem der Workflow alle erforderlichen Prüfungen bestanden hat. Weitere Informationen findest du unter Erzwingen der Abhängigkeitsüberprüfung in einer Organisation.

Here is a list of common configuration options. For more information, and a full list of options, see Dependency Review on the GitHub Marketplace.

Option	Required	Usage
fail-on-severity		Defines the threshold for level of severity (low, moderate, high, critical). The action will fail on any pull requests that introduce vulnerabilities of the specified severity level or higher.
allow-licenses		Contains a list of allowed licenses. You can find the possible values for this parameter in the Licenses page of the API documentation. The action will fail on pull requests that introduce dependencies with licenses that do not match the list.
deny-licenses		Contains a list of prohibited licenses. You can find the possible values for this parameter in the Licenses page of the API documentation. The action will fail on pull requests that introduce dependencies with licenses that match the list.
fail-on-scopes		Contains a list of strings representing the build environments you want to support (development, runtime, unknown). The action will fail on pull requests that introduce vulnerabilities in the scopes that match the list.
comment-summary-in-pr		Enable or disable the reporting of the review summary as a comment in the pull request. If enabled, you must give the workflow or job the pull-requests: write permission.
allow-ghsas		Contains a list of GitHub Advisory Database IDs that can be skipped during detection. You can find the possible values for this parameter in the GitHub Advisory Database.
config-file		Specifies a path to a configuration file. The configuration file can be local to the repository or a file located in an external repository.
external-repo-token		Specifies a token for fetching the configuration file, if the file resides in a private external repository. The token must have read access to the repository.

Configuring the Abhängigkeitsüberprüfungsaktion

There are two methods of configuring the Abhängigkeitsüberprüfungsaktion:

• Inlining the configuration options in your workflow file.
• Referencing a configuration file in your workflow file.

Notice that all of the examples use a short version number for the action (v3) instead of a semver release number (for example, v3.0.8). This ensures that you use the most recent minor version of the action.

Using inline configuration to set up the Abhängigkeitsüberprüfungsaktion

1. Add a new YAML workflow to your .github/workflows folder.

   YAML

   name: 'Dependency Review'
   on: [pull_request]
   
   permissions:
     contents: read
   
   jobs:
     dependency-review:
       runs-on: ubuntu-latest
       steps:
        - name: 'Checkout Repository'
          uses: actions/checkout@v4
        - name: Dependency Review
          uses: actions/dependency-review-action@v4
   

2. Specify your settings.

   This Abhängigkeitsüberprüfungsaktion example file illustrates how you can use the available configuration options.

   YAML

   name: 'Dependency Review'
   on: [pull_request]
   
   permissions:
     contents: read
   
   jobs:
     dependency-review:
       runs-on: ubuntu-latest
       steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@v4
       - name: Dependency Review
         uses: actions/dependency-review-action@v4
         with:
           # Possible values: "critical", "high", "moderate", "low"
           fail-on-severity: critical
   
           
           # You can only include one of these two options: `allow-licenses` and `deny-licenses`
           # ([String]). Only allow these licenses (optional)
           # Possible values: Any SPDX-compliant license identifiers or expressions from https://spdx.org/licenses/
           allow-licenses: GPL-3.0, BSD-3-Clause, MIT
           # ([String]). Block the pull request on these licenses (optional)
           # Possible values: Any SPDX-compliant license identifiers or expressions from https://spdx.org/licenses/
           deny-licenses: LGPL-2.0, BSD-2-Clause
           
           # ([String]). Skip these GitHub Advisory Database IDs during detection (optional)
           # Possible values: Any valid GitHub Advisory Database ID from https://github.com/advisories
           allow-ghsas: GHSA-abcd-1234-5679, GHSA-efgh-1234-5679
           # ([String]). Block pull requests that introduce vulnerabilities in the scopes that match this list (optional)
           # Possible values: "development", "runtime", "unknown"
           fail-on-scopes: development, runtime
   

Using a configuration file to set up Abhängigkeitsüberprüfungsaktion

1. Add a new YAML workflow to your .github/workflows folder and use config-file to specify that you are using a configuration file.

   YAML

   name: 'Dependency Review'
   on: [pull_request]
   
   permissions:
    contents: read
   
   jobs:
     dependency-review:
       runs-on: ubuntu-latest
       steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@v4
       - name: Dependency Review
         uses: actions/dependency-review-action@v4
         with:
          # ([String]). Representing a path to a configuration file local to the repository or in an external repository.
          # Possible values: An absolute path to a local file or an external file.
          config-file: './.github/dependency-review-config.yml'
          # Optional alternative syntax for an external file: OWNER/REPOSITORY/FILENAME@BRANCH (uncomment if preferred)
          # config-file: 'github/octorepo/dependency-review-config.yml@main'
   
          # ([Token]) Use if your configuration file resides in a private external repository.
          # Possible values: Any GitHub token with read access to the private external repository.
          external-repo-token: 'ghp_123456789abcde'
   

2. Create the configuration file in the path you have specified.

   This YAML example file illustrates how you can use the available configuration options.

   YAML

     # Possible values: "critical", "high", "moderate", "low"
     fail-on-severity: critical
   
     # You can only include one of these two options: `allow-licenses` and `deny-licenses`
     # ([String]). Only allow these licenses (optional)
     # Possible values: Any SPDX-compliant license identifiers or expressions from https://spdx.org/licenses/
     allow-licenses:
       - GPL-3.0
       - BSD-3-Clause
       - MIT
      # ([String]). Block the pull request on these licenses (optional)
      # Possible values: Any SPDX-compliant license identifiers or expressions from https://spdx.org/licenses/
     deny-licenses:
       - LGPL-2.0
       - BSD-2-Clause
   
      # ([String]). Skip these GitHub Advisory Database IDs during detection (optional)
      # Possible values: Any valid GitHub Advisory Database ID from https://github.com/advisories
     allow-ghsas:
       - GHSA-abcd-1234-5679
       - GHSA-efgh-1234-5679
      # ([String]). Block pull requests that introduce vulnerabilities in the scopes that match this list (optional)
      # Possible values: "development", "runtime", "unknown"
     fail-on-scopes:
       - development
       - runtime
   

For further details about the configuration options, see dependency-review-action.

Further reading

• "Anpassung Ihrer Aktionskonfiguration für die Überprüfung von Abhängigkeiten"