From ffc357c6a1dd6b739c4e09133a2c0ef22bb9a397 Mon Sep 17 00:00:00 2001 From: Evan Rusackas Date: Mon, 22 Jan 2024 13:50:16 -0700 Subject: [PATCH] chore(dependencies): loosen constraints on dependency checker (#26708) --- .github/workflows/dependency-review.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index ba00b5d3db251..d0804c7a74d98 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -4,7 +4,7 @@ # # Source repository: https://github.com/actions/dependency-review-action # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement -name: 'Dependency Review' +name: "Dependency Review" on: [pull_request] permissions: @@ -14,12 +14,12 @@ jobs: dependency-review: runs-on: ubuntu-latest steps: - - name: 'Checkout Repository' + - name: "Checkout Repository" uses: actions/checkout@v3 - - name: 'Dependency Review' + - name: "Dependency Review" uses: actions/dependency-review-action@v2 with: - fail-on-severity: high + fail-on-severity: critical # compatible/incompatible licenses addressed here: https://www.apache.org/legal/resolved.html # find SPDX identifiers here: https://spdx.org/licenses/ deny-licenses: MS-LPL, BUSL-1.1, QPL-1.0, Sleepycat, SSPL-1.0, CPOL-1.02, AGPL-3.0, GPL-1.0+, BSD-4-Clause-UC, NPL-1.0, NPL-1.1, JSON