actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

installation section

Browse Source
This commit is contained in:
Anne-Marie
2024-05-23 09:37:47 +00:00
parent 4c0a483c95
commit 258a2295c6
1 changed files with 45 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+45 -39
View File
@@ -14,6 +14,10 @@
The dependency review action scans your pull requests for dependency changes, and will raise an error if any vulnerabilities or invalid licenses are being introduced. The dependency review action scans your pull requests for dependency changes, and will raise an error if any vulnerabilities or invalid licenses are being introduced.
The action is supported by an [API endpoint](https://docs.github.com/en/rest/dependency-graph/dependency-review?apiVersion=2022-11-28) that diffs the dependencies between any two revisions on your default branch. The action is supported by an [API endpoint](https://docs.github.com/en/rest/dependency-graph/dependency-review?apiVersion=2022-11-28) that diffs the dependencies between any two revisions on your default branch.
The action is available for:
- Public repositories
- Private repositories with a [GitHub Advanced Security](https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security) license.
When the action runs, you can see the results on: When the action runs, you can see the results on:
- The **job logs**, found .... - The **job logs**, found ....
@@ -24,58 +28,60 @@ When the action runs, you can see the results on:
<img width="850" alt="GitHub job summary showing Dependency Review output" src="https://github.com/actions/dependency-review-action/assets/2161/42fbed1d-64a7-42bf-9b05-c416bc67493f"> <img width="850" alt="GitHub job summary showing Dependency Review output" src="https://github.com/actions/dependency-review-action/assets/2161/42fbed1d-64a7-42bf-9b05-c416bc67493f">
The action is available for:
- Public repositories
- Private repositories with a [GitHub Advanced Security](https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security) license.
## Installation ## Installation
**Please keep in mind that you need a [GitHub Advanced Security](https://docs.github.com/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security) license if you're running this action on private repositories.** - [Installation (standard)](#installation)
- [Installation (GitHub Enterprise Server)](#installation-github-enterprise-server)
#### Installation (standard)
You can install the action on any public repository, or any organization-owned private repository, provided the organization has a GitHub Advanced Security license.
1. Add a new YAML workflow to your `.github/workflows` folder: 1. Add a new YAML workflow to your `.github/workflows` folder:
```yaml ```yaml
name: 'Dependency Review' name: 'Dependency Review'
on: [pull_request] on: [pull_request]
permissions: permissions:
contents: read contents: read
jobs: jobs:
dependency-review: dependency-review:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: 'Checkout Repository' - name: 'Checkout Repository'
uses: actions/checkout@v4 uses: actions/checkout@v4
- name: 'Dependency Review' - name: 'Dependency Review'
uses: actions/dependency-review-action@v4 uses: actions/dependency-review-action@v4
``` ```
### GitHub Enterprise Server #### Installation (GitHub Enterprise Server)
Make sure You can install the action on repositories on GitHub Enterprise Server.
[GitHub Advanced
Security](https://docs.github.com/[email protected]/admin/code-security/managing-github-advanced-security-for-your-enterprise/enabling-github-advanced-security-for-your-enterprise)
and [GitHub
Connect](https://docs.github.com/[email protected]/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect)
are enabled, and that you have installed the [dependency-review-action](https://github.com/actions/dependency-review-action) on the server.
You can use the same workflow as above, replacing the `runs-on` value 1. Ensure [GitHub Advanced Security](https://docs.github.com/en/[email protected]/admin/code-security/managing-github-advanced-security-for-your-enterprise/enabling-github-advanced-security-for-your-enterprise) and [GitHub Connect](https://docs.github.com/en/[email protected]/admin/github-actions/managing-access-to-actions-from-githubcom/enabling-automatic-access-to-githubcom-actions-using-github-connect) are enabled for the enterprise.
with the label of any of your runners (the default label 2. Ensure you have installed the [dependency-review-action](https://github.com/actions/dependency-review-action) on the server.
is `self-hosted`): 3. Add a new YAML workflow to your `.github/workflows` folder:
```yaml ``` yaml
# ... name: 'Dependency Review'
on: [pull_request]
jobs: permissions:
dependency-review: contents: read
runs-on: self-hosted
steps: jobs:
- name: 'Checkout Repository' dependency-review:
uses: actions/checkout@v4 runs-on: self-hosted
- name: 'Dependency Review' steps:
uses: actions/dependency-review-action@v4 - name: 'Checkout Repository'
``` uses: actions/checkout@v4
- name: 'Dependency Review'
uses: actions/dependency-review-action@v4
```
5. In the workflow file, replace the `runs-on` value with the label of any of your runners. (The default value is `self-hosted`.)
## Configuration options ## Configuration options