Transaction links point somewhere real; mobile marketplace spec stays offline #1588
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review | |
| # Blocks PRs that introduce dependencies with known vulnerabilities. | |
| # Free, runs on every PR, complements the heavier npm-audit + govulncheck | |
| # already in ci.yml. See docs/DEPENDENCY_POLICY.md §11. | |
| on: | |
| pull_request: | |
| branches: [main, dev/v2] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Review | |
| uses: actions/dependency-review-action@v5 | |
| with: | |
| fail-on-severity: high | |
| # Acknowledged advisories — kept in sync with the ALLOWLIST in | |
| # frontend/scripts/audit-ci.mjs, which carries the full written | |
| # justification for each entry. The sync is ENFORCED by a test | |
| # (frontend/scripts/audit-ci.test.ts), not by this comment. | |
| # | |
| # Why it matters that these two agree: `Dependency Review` only | |
| # evaluates dependencies a PR CHANGES, so bumping react-router by a | |
| # single patch made this job red over an advisory we had already | |
| # formally acknowledged and that the PR was not fixing — a false red | |
| # on unrelated work. | |
| # | |
| # There is currently NOTHING to allow: audit-ci.mjs's ALLOWLIST is empty, | |
| # so no `allow-ghsas` key belongs here either. The two are asserted | |
| # identical by frontend/scripts/audit-ci.test.ts — if you add an entry to | |
| # one side, that test fails until you add it to the other. | |
| # Allow common permissive licenses. Reject everything else (unknown | |
| # OSS license = manual review). Add new licenses here only after a | |
| # case-by-case sign-off. | |
| # | |
| # LicenseRef-scancode-google-patent-license-golang (signed off | |
| # 2026-08-16, #1044): the PATENTS file every golang.org/x module | |
| # ships — Google's patent grant, an additional permission on top of | |
| # BSD-3-Clause, the same terms Go itself is under. Scancode reports | |
| # it as `BSD-3-Clause AND LicenseRef-...`, and the gate requires | |
| # every operand of an AND to be allowed, so without this entry any | |
| # golang.org/x bump can trip the gate (first hit: cosmos-sdk 0.55.0 | |
| # pulling x/exp). | |
| allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, 0BSD, Unlicense, CC0-1.0, LicenseRef-bad-see-license-in-license.md, LicenseRef-scancode-google-patent-license-golang | |
| comment-summary-in-pr: on-failure |