enabled dependency_review

.github/dependency_review.yml

@@ -0,0 +1,18 @@
+fail-on-severity: 'low'
+allow-licenses:
+  - 'BSD-2-Clause'
+  - 'BSD-3-Clause'
+  - 'BSD-2-Clause AND BSD-3-Clause'
+  - 'MIT'
+  - 'Apache-2.0'
+  - 'ISC'
+  - 'Apache-2.0 AND MIT'
+  - 'BlueOak-1.0.0'
+  - '0BSD'
+  - 'Python-2.0'
+fail-on-scopes:
+  - 'runtime'
+  - 'development'
+  - 'unknown'
+license-check: true
+vulnerability-check: true

.github/workflows/sdl.yml

@@ -23,7 +23,7 @@ env:
 jobs:
   sdl_tests:
     name: SDL tests
-    timeout-minutes: 5
+    timeout-minutes: 10
     defaults:
       run:
         shell: bash
@@ -53,3 +53,8 @@ jobs:
           scan-type: 'fs'
           scan-ref: '.'
 
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          config-file: './.github/dependency_review.yml'
+