Skip to content

feat(ci): add GitHub Dependency Review workflow - #241

Open
AnzalKhan16 wants to merge 1 commit into
optiqor:mainfrom
AnzalKhan16:feat/add-dependency-review
Open

feat(ci): add GitHub Dependency Review workflow#241
AnzalKhan16 wants to merge 1 commit into
optiqor:mainfrom
AnzalKhan16:feat/add-dependency-review

Conversation

@AnzalKhan16

Copy link
Copy Markdown
Contributor

What

This pull request adds a GitHub Actions workflow that automatically reviews dependency changes introduced through pull requests using GitHub's official Dependency Review Action.

The workflow detects vulnerable dependency updates and provides an automated summary within pull requests.

Why

Fixes #240

Automating dependency review improves software supply chain security by identifying vulnerable or risky dependency changes before they are merged.

How

  • Added a new .github/workflows/dependency-review.yml workflow.
  • Uses GitHub's official Dependency Review Action.
  • Runs on pull requests targeting the main branch.
  • Fails the workflow if dependencies with High or Critical severity vulnerabilities are introduced.
  • Posts a dependency review summary in the pull request.

Testing

  • go build ./... passes
  • go test ./... passes
  • go vet ./... passes
  • golangci-lint run ./... passes
  • N/A — workflow-only change (no application or eBPF code modified)

Checklist

  • PR title follows Conventional Commits (feat(ci): ...)
  • All commits are DCO-signed
  • No unrelated changes pulled in
  • Documentation updated where user-visible behavior changed
  • Added/updated tests for new code paths
  • No doctor rule changes

Signed-off-by: AnzalKhan16 <arrowsasuke93@gmail.com>
@AnzalKhan16
AnzalKhan16 requested a review from btwshivam as a code owner July 3, 2026 16:42
@github-actions github-actions Bot added level:intermediate 50-200 lines or 3-5 files (auto-applied) testing Tests and test coverage labels Jul 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

level:intermediate 50-200 lines or 3-5 files (auto-applied) testing Tests and test coverage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat: Add GitHub Dependency Review Action for Pull Requests

1 participant