Add self-hosted Excel integration runner #1053
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependency Review Workflow | |
| # Scans pull requests for vulnerable dependencies before merging | |
| name: 'Dependency Review' | |
| on: | |
| pull_request: | |
| branches: [ "main", "develop" ] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v5 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v5 | |
| with: | |
| # Fail the build if vulnerabilities are found | |
| fail-on-severity: moderate | |
| # Fail if GPL/AGPL/LGPL licenses detected; allow common permissive/OSI-approved licenses | |
| license-check: true | |
| # Python-2.0 allowed for the npm `argparse` package (a JS port of Python's | |
| # argparse, transitive dep of @changesets/cli via js-yaml) - it's an | |
| # OSI-approved, permissive, non-copyleft license. | |
| allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, LicenseRef-scancode-generic-cla, BlueOak-1.0.0, CC0-1.0, MPL-2.0, Python-2.0 | |
| # Comment on PR with summary | |
| comment-summary-in-pr: always | |
| # Show vulnerabilities by severity | |
| warn-only: false | |
| # Block critical and high severity vulnerabilities | |
| fail-on-scopes: runtime, development | |
| # Additional configuration | |
| base-ref: ${{ github.event.pull_request.base.sha }} | |
| head-ref: ${{ github.event.pull_request.head.sha }} | |
| # Known unfixable transitive vulnerabilities in dev-only build tools | |
| # minimatch@3.x ReDoS in @vscode/vsce (no fix available upstream) | |
| allow-ghsas: GHSA-3ppc-4f35-3m26 | |
| - name: Dependency Review Summary | |
| if: always() | |
| run: | | |
| echo "✅ Dependency review completed" | |
| echo "Review results are available in the Security tab" |