dependency-review.yml

name: 'Dependency Review'
on:
  pull_request:
    paths:
      - '.github/workflows/**'
      - 'package.json'
      - 'package-lock.json'

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-24.04
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v4
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@v4
        with:
          # https://spdx.org/licenses/
          allow-licenses: MIT, BSD-3-Clause, BSD-2-Clause, 0BSD, Unlicense, ISC, Apache-2.0
          allow-dependencies-licenses: pkg:githubactions/DeterminateSystems/nix-installer-action@5