hve-core/.github/workflows/dependency-review.yml at cbc16ccea9230838e83dc529286d1a29b348dc11 · eedorenko/hve-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
# Copyright (c) 2026 Microsoft Corporation. All rights reserved.
# SPDX-License-Identifier: MIT
name: Dependency Review

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
    paths:
      - '**/package.json'
      - '**/package-lock.json'
      - '**/pyproject.toml'
      - '**/uv.lock'
      - '**/requirements*.txt'
      - '.github/workflows/dependency-review.yml'
  workflow_call:

permissions:
  contents: read

jobs:
  dependency-review:
    name: Review Dependencies
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Elevated for Dependency Submission API (uv.lock)
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Submit uv.lock dependencies  # Runs on push (base snapshots) and non-fork PRs
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: advanced-security/component-detection-dependency-submission-action@b876b8cc341a53970394b33ea0ca4e86c25542de # v0.1.3
        with:
          detectorArgs: 'UvLock=EnableIfDefaultOff'

      - name: Dependency Review
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          retry-on-snapshot-warnings: true
          retry-on-snapshot-warnings-timeout: 120
          fail-on-severity: moderate
          # GHSA-69w3-r845-3855 (CVE-2026-1839): transformers Trainer
          # arbitrary code execution via torch.load() without weights_only.
          # The advisory states the issue only affects torch>=2.2 used with
          # PyTorch < 2.6; the moderation eval pins torch==2.9.1 (>=2.6), so
          # safe_globals() protection applies and the path is not exploitable.
          # The only patched release (5.0.0rc3) is a pre-release that breaks
          # detoxify==0.5.2, which requires transformers<5.
          allow-ghsas: GHSA-69w3-r845-3855
          comment-summary-in-pr: always
          license-check: true
          allow-licenses: >-
            MIT, MIT-0, MIT-CMU, Apache-2.0,
            BSD-2-Clause, BSD-3-Clause, ISC, 0BSD,
            BlueOak-1.0.0, CC0-1.0, Unlicense,
            CC-BY-4.0, CC-BY-3.0, PSF-2.0, Python-2.0,
            HPND, LicenseRef-scancode-secret-labs-2011,
            WTFPL, LicenseRef-scancode-unicode
          # Packages with compound SPDX expressions containing GPL or MPL
          # from bundled code; distributed licenses are permissive.
          # @github/copilot and its platform-specific binaries (including
          # @github/copilot-linuxmusl-arm64 and @github/copilot-linuxmusl-x64
          # added in v1.0.63) use a non-SPDX proprietary license
          # (LicenseRef-bad-see-license-in-license.md); it is GitHub's own
          # CLI toolchain, deliberately used in beval.yml.
          # pkg:npm/hve-core is the private root package (never published to npm).
          # pkg:pypi/certifi uses MPL-2.0 (Mozilla CA bundle).
          # pkg:pypi/charset-normalizer is MIT licensed but some older wheel
          # metadata declares a compound SPDX expression; the action treats
          # compound expressions as a mismatch against allow-licenses.
          # pkg:pypi/shapely declares a compound SPDX expression
          # (BSD-3-Clause AND LGPL-2.1-only); shapely's distributed code is
          # BSD-3-Clause and the LGPL component refers to bundled GEOS headers.
          # The mural skill keyring/cryptography stack below ships permissive
          # licenses (Apache-2.0, MIT, BSD-3-Clause, PSF-2.0) per each
          # project's source repository, but PyPI metadata reports "unknown"
          # so the action requires explicit allowlisting.
          # pkg:npm/lightningcss (and its optional platform-specific binaries)
          # is MPL-2.0 licensed; it is pulled in transitively by
          # @docusaurus/faster's Rspack toolchain. MPL-2.0 is file-level
          # copyleft and safe to consume as a dependency.
          # pkg:npm/uri-js declares a compound SPDX expression
          # (BSD-2-Clause AND BSD-2-Clause-Views); both components are
          # permissive BSD variants, but the action treats the compound
          # expression as a mismatch against allow-licenses.
          # The pkg:pypi/torch ML stack below is the transitive dependency
          # graph of the moderation eval (scripts/evals/moderation). torch
          # resolves from the CPU-only wheel index
          # (download.pytorch.org/whl/cpu), so the nvidia-*-cu12 CUDA runtime
          # libraries are no longer pulled in. PyPI metadata reports
          # "unknown" for the remaining packages so the action cannot match
          # them against allow-licenses: torch is BSD-3-Clause; filelock is
          # Unlicense (public domain); hf-xet, idna, and safetensors ship
          # permissive licenses (Apache-2.0 / BSD-style) per their source
          # repositories. pkg:pypi/regex declares a compound SPDX expression
          # (CNRI-Python AND Apache-2.0) and is pulled transitively by
          # transformers; CNRI-Python is a permissive PSF-style license. The
          # moderation eval is an internal test harness, not a distributed
          # product.
          allow-dependencies-licenses: >-
            pkg:pypi/lxml,
            pkg:pypi/typing-extensions,
            pkg:pypi/certifi,
            pkg:pypi/charset-normalizer,
            pkg:pypi/shapely,
            pkg:pypi/backports-tarfile,
            pkg:pypi/cryptography,
            pkg:pypi/jaraco-classes,
            pkg:pypi/jaraco-context,
            pkg:pypi/jaraco-functools,
            pkg:pypi/keyrings-alt,
            pkg:pypi/torch,
            pkg:pypi/filelock,
            pkg:pypi/hf-xet,
            pkg:pypi/idna,
            pkg:pypi/safetensors,
            pkg:pypi/regex,
            pkg:npm/dompurify,
            pkg:npm/lunr-languages,
            pkg:npm/%40github/copilot,
            pkg:npm/%40github/copilot-darwin-arm64,
            pkg:npm/%40github/copilot-darwin-x64,
            pkg:npm/%40github/copilot-linux-arm64,
            pkg:npm/%40github/copilot-linux-x64,
            pkg:npm/%40github/copilot-win32-arm64,
            pkg:npm/%40github/copilot-win32-x64,
            pkg:npm/%40github/copilot-linuxmusl-arm64,
            pkg:npm/%40github/copilot-linuxmusl-x64,
            pkg:npm/lightningcss,
            pkg:npm/lightningcss-android-arm64,
            pkg:npm/lightningcss-darwin-arm64,
            pkg:npm/lightningcss-darwin-x64,
            pkg:npm/lightningcss-freebsd-x64,
            pkg:npm/lightningcss-linux-arm-gnueabihf,
            pkg:npm/lightningcss-linux-arm64-gnu,
            pkg:npm/lightningcss-linux-arm64-musl,
            pkg:npm/lightningcss-linux-x64-gnu,
            pkg:npm/lightningcss-linux-x64-musl,
            pkg:npm/lightningcss-win32-arm64-msvc,
            pkg:npm/lightningcss-win32-x64-msvc,
            pkg:npm/uri-js,
            pkg:npm/hve-core
          show-openssf-scorecard: true
          warn-on-openssf-scorecard-level: 3