Skip to content

Add centralized dependency review#1

Merged
acgxv merged 1 commit into
mainfrom
agent/dependency-review
Jul 19, 2026
Merged

Add centralized dependency review#1
acgxv merged 1 commit into
mainfrom
agent/dependency-review

Conversation

@acgxv

@acgxv acgxv commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

What changed

  • add an enterprise ruleset-compatible dependency review workflow
  • block newly introduced high and critical vulnerabilities
  • support pull requests and merge queues
  • pin all third-party actions to full commit SHAs

Why

This provides one centrally maintained dependency review check for repositories in the acg-box organization. Target repositories do not need caller workflows.

Validation

  • actionlint .github/workflows/dependency-review.yml
  • git diff --check main...HEAD
  • verified action release tags resolve to the pinned full commit SHAs

…iew","authority":"manual","impact":"compatible"}
@acgxv
acgxv marked this pull request as ready for review July 19, 2026 13:05
@acgxv
acgxv merged commit eb76d78 into main Jul 19, 2026
1 check passed
@acgxv
acgxv deleted the agent/dependency-review branch July 19, 2026 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant