fix: (dependency review) new preset allow-listing certain deps

.changeset/tiny-tigers-sip.md

@@ -0,0 +1,5 @@
+---
+"dependency-review": patch
+---
+
+custom preset allowing excluded licenses for dependencies chainlink/contracts and arbitrum/nitro-contracts

actions/dependency-review/configs/license-deny-vulnerability-high-custom.yml

@@ -0,0 +1,145 @@
+# Note: This is an extension of 'license-deny-vulnerability-high' preset. Changes there should be propagated here.
+
+# CUSTOM ENTRIES
+# ---
+# Allow specific dependencies with licenses that would otherwise be denied.
+allow_dependencies_licenses:
+  - "pkg:npm/@arbitrum/nitro-contracts"
+  - "pkg:npm/@chainlink/contracts"
+
+# ORIGINAL PRESET (license-deny-vulnerability-high)
+# ---
+# Fails when:
+# - a dependency is found with a license that is in the deny_licenses list
+# - vulnerabilities are found in the dependency tree with specified severity or grater
+vulnerability_check: true
+fail_on_severity: "high" # low, moderate, high, critical
+license_check: true
+
+# Contains a list of prohibited licenses. The action will fail on pull requests
+# that introduce dependencies with licenses that match the list.
+deny_licenses:
+  - AGPL-1.0-only
+  - AGPL-1.0-or-later
+  - AGPL-3.0-only
+  - AGPL-3.0-or-later
+  - APL-1.0
+  - Aladdin
+  - BUSL-1.1
+  - CC-BY-1.0
+  - CC-BY-2.0
+  - CC-BY-2.5
+  - CC-BY-2.5-AU
+  - CC-BY-3.0
+  - CC-BY-3.0-AT
+  - CC-BY-3.0-DE
+  - CC-BY-3.0-IGO
+  - CC-BY-3.0-NL
+  - CC-BY-3.0-US
+  - CC-BY-4.0
+  - CC-BY-NC-1.0
+  - CC-BY-NC-2.0
+  - CC-BY-NC-2.5
+  - CC-BY-NC-3.0
+  - CC-BY-NC-3.0-DE
+  - CC-BY-NC-4.0
+  - CC-BY-NC-ND-1.0
+  - CC-BY-NC-ND-2.0
+  - CC-BY-NC-ND-2.5
+  - CC-BY-NC-ND-3.0
+  - CC-BY-NC-ND-3.0-DE
+  - CC-BY-NC-ND-3.0-IGO
+  - CC-BY-NC-ND-4.0
+  - CC-BY-NC-SA-1.0
+  - CC-BY-NC-SA-2.0
+  - CC-BY-NC-SA-2.0-DE
+  - CC-BY-NC-SA-2.0-FR
+  - CC-BY-NC-SA-2.0-UK
+  - CC-BY-NC-SA-2.5
+  - CC-BY-NC-SA-3.0
+  - CC-BY-NC-SA-3.0-DE
+  - CC-BY-NC-SA-3.0-IGO
+  - CC-BY-NC-SA-4.0
+  - CC-BY-ND-1.0
+  - CC-BY-ND-2.0
+  - CC-BY-ND-2.5
+  - CC-BY-ND-3.0
+  - CC-BY-ND-3.0-DE
+  - CC-BY-ND-4.0
+  - CC-BY-SA-1.0
+  - CC-BY-SA-2.0
+  - CC-BY-SA-2.0-UK
+  - CC-BY-SA-2.1-JP
+  - CC-BY-SA-2.5
+  - CC-BY-SA-3.0
+  - CC-BY-SA-3.0-AT
+  - CC-BY-SA-3.0-DE
+  - CC-BY-SA-3.0-IGO
+  - CC-BY-SA-4.0
+  - CC-PDDC
+  - copyleft-next-0.3.0
+  - copyleft-next-0.3.1
+  - CPAL-1.0
+  - CPL-1.0
+  - EPL-1.0
+  - EPL-2.0
+  - EUPL-1.0
+  - EUPL-1.1
+  - EUPL-1.2
+  - ErlPL-1.1
+  - GFDL-1.1-invariants-only
+  - GFDL-1.1-invariants-or-later
+  - GFDL-1.1-no-invariants-only
+  - GFDL-1.1-no-invariants-or-later
+  - GFDL-1.1-only
+  - GFDL-1.1-or-later
+  - GFDL-1.2-invariants-only
+  - GFDL-1.2-invariants-or-later
+  - GFDL-1.2-no-invariants-only
+  - GFDL-1.2-no-invariants-or-later
+  - GFDL-1.2-only
+  - GFDL-1.2-or-later
+  - GFDL-1.3-invariants-only
+  - GFDL-1.3-invariants-or-later
+  - GFDL-1.3-no-invariants-only
+  - GFDL-1.3-no-invariants-or-later
+  - GFDL-1.3-only
+  - GFDL-1.3-or-later
+  - GPL-1.0-only
+  - GPL-1.0-or-later
+  - GPL-2.0-only
+  - GPL-2.0-or-later
+  - GPL-3.0-only
+  - GPL-3.0-or-later
+  - IPL-1.0
+  - LGPL-2.0-only
+  - LGPL-2.0-or-later
+  - LGPL-2.1-only
+  - LGPL-2.1-or-later
+  - LGPL-3.0-only
+  - LGPL-3.0-or-later
+  - MPL-1.0
+  - MPL-1.1
+  - MPL-2.0
+  - MPL-2.0-no-copyleft-exception
+  - OFL-1.0
+  - OFL-1.0-RFN
+  - OFL-1.0-no-RFN
+  - OFL-1.1
+  - OFL-1.1-RFN
+  - OFL-1.1-no-RFN
+  - OSL-1.0
+  - OSL-1.1
+  - OSL-2.0
+  - OSL-2.1
+  - OSL-3.0
+  - RPL-1.1
+  - RPL-1.5
+  - RPSL-1.0
+  - SISSL
+  - SISSL-1.2
+  - SPL-1.0
+  - SunPro
+  - Watcom-1.0
+  - YPL-1.0
+  - YPL-1.1

actions/dependency-review/configs/license-deny-vulnerability-high.yml

@@ -1,3 +1,5 @@
+# Note: If updating this file, ensure to propagate changes to 'license-deny-vulnerability-high-custom' preset.
+
 # Fails when:
 # - a dependency is found with a license that is in the deny_licenses list
 # - vulnerabilities are found in the dependency tree with specified severity or grater