Skip to content

ci(workflows): use central reusable dependency-review.yml #556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 1 commit into from
Sep 2, 2026
Merged

ci(workflows): use central reusable dependency-review.yml #556

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 7 additions & 18 deletions .github/workflows/dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,24 +4,13 @@
pull_request:
branches: [main, developmental]

permissions:
contents: read
pull-requests: read
concurrency:
group: dependency-review-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

jobs:
dependency-review:
name: dependency-review
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Dependency review
continue-on-error: true
uses: actions/dependency-review-action@v4
with:
fail-on-severity: moderate
- name: Dependency review availability note
if: always()
run: |
echo "Dependency Review requires GitHub Dependency Graph to be enabled for this repository."
echo "OSV-Scanner remains the blocking dependency vulnerability gate."
uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main

@devin-ai-integration devin-ai-integration Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

馃煛 Dependency review cannot start

dependency-review references @main, but that branch does not contain the reusable workflow. Every pull request run fails before dependency review starts.

Prompt for agents 
The caller in .github/workflows/dependency-review.yml references ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@main, but the central repository's main branch does not contain that file. It exists only on the unmerged ContextualWisdomLab/.github#1724 head. Ensure the central workflow is merged and available at the referenced revision before merging or running this caller, or temporarily reference an available immutable revision and update it after the central change lands.
Devin Review

Was this helpful? React with 馃憤 or 馃憥 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

馃煥 Mutable workflow reference permits unreviewed changes

dependency-review trusts another repository's mutable @main branch. Later central changes execute here without a reviewed caller update.

Devin Review

Was this helpful? React with 馃憤 or 馃憥 to provide feedback.

with:
fail_on_severity: moderate
continue_on_error: true
Loading