You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kyuubi.apache.org by bo...@apache.org on 2023/02/09 06:15:05 UTC
[kyuubi] branch master updated: [KYUUBI #4266] [INFRA] Add Dependency Review step to prevent introducing vulnerable dependencies
This is an automated email from the ASF dual-hosted git repository.
bowenliang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/kyuubi.git
The following commit(s) were added to refs/heads/master by this push:
new 953155272 [KYUUBI #4266] [INFRA] Add Dependency Review step to prevent introducing vulnerable dependencies
953155272 is described below
commit 953155272054137bab1d2e59c910b1ccf614ff56
Author: liangbowen <li...@gf.com.cn>
AuthorDate: Thu Feb 9 14:14:55 2023 +0800
[KYUUBI #4266] [INFRA] Add Dependency Review step to prevent introducing vulnerable dependencies
### _Why are the changes needed?_
- Add actions/dependency-review-action (https://github.com/actions/dependency-review-action) as new step in the dependency workflow, which fails when future PR is bringing vulnerable dependencies.
- configuring `fail-on-severity` to `moderate` level
<img width="760" alt="image" src="https://user-images.githubusercontent.com/1935105/217551476-e2858c04-ebcb-4028-a209-e547690b5d79.png">
### _How was this patch tested?_
- [x] Pass the Dependency Check CI job
Closes #4266 from bowenliang123/dependency-review.
Closes #4266
63a84b22 [liangbowen] add actions/dependency-review-action to dependency workflow
Authored-by: liangbowen <li...@gf.com.cn>
Signed-off-by: liangbowen <li...@gf.com.cn>
---
.github/workflows/dep.yml | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/dep.yml b/.github/workflows/dep.yml
index 5ea4447cc..ae1e3de6f 100644
--- a/.github/workflows/dep.yml
+++ b/.github/workflows/dep.yml
@@ -23,8 +23,9 @@ on:
- master
- branch-*
paths:
- # dependency check happens only pom changes
+ # when pom or dependency workflow changes
- '**/pom.xml'
+ - '.github/workflows/dep.yml'
concurrency:
group: dep-${{ github.ref }}
@@ -57,3 +58,7 @@ jobs:
-pl kyuubi-ctl,kyuubi-server,kyuubi-assembly -am
- name: Check dependency list
run: build/dependency.sh
+ - name: Dependency Review
+ uses: actions/dependency-review-action@v3
+ with:
+ fail-on-severity: moderate