ci: skip dependency-review job on fork repositories (#243)

[AndreasIgel]

Fixes #243.

Summary

The dependency-review GitHub Action requires the repository's dependency graph to be enabled. Forks typically do not have this feature enabled, so the action fails on every fork PR. The maven.yml SonarCloud and Codecov upload steps are already gated on the presence of SONAR_TOKEN and CODECOV_TOKEN (they are exposed as job-level env variables and skipped when empty for fork PRs).

Changes

• Add if: github.event.repository.fork == false to the dependency-review job so it only runs on the upstream/non-fork repository where the dependency graph is available.

Note

Because this workflow uses pull_request_target, the dependency-review check on this PR itself still runs from the main branch workflow file (which does not yet contain the guard). The skip will be active for all subsequent PRs once this change is merged.

This keeps fork PRs green without affecting the upstream repository's security scanning.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA deb1f9e.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Vulnerabilities

example/pom.xml

Name	Version	Vulnerability	Severity
org.apache.logging.log4j:log4j-core	2.14.1	Incomplete fix for Apache Log4j vulnerability	critical
		Remote code injection in Log4j	critical
		Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion	high

Only included vulnerabilities with severity high or higher.

License Issues

example/pom.xml

Package	Version	License	Issue Type
com.mysql:mysql-connector-j	9.1.0	GPL-2.0-only WITH Universal-FOSS-exception-1.0 AND LicenseRef-github-OTHER	Incompatible License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0

OpenSSF Scorecard

Package	Version	Score	Details
maven/org.apache.logging.log4j:log4j-core	2.14.1	Unknown	Unknown
maven/com.mysql:mysql-connector-j	9.1.0	🟢 5.5	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 13 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow ⚠️ -1 no workflows found Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ -1 No tokens found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected SAST ⚠️ 0 no SAST tool detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ -1 no dependencies found License 🟢 9 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches

Scanned Files

• example/pom.xml

[AndreasIgel]

Wrong source branch