Merge pull request #1500 from actions/elireisman/dr-action

Add Security Gallery entry for new Dependency Review Action

code-scanning/dependency-review.yml

@@ -0,0 +1,20 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Reqest, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v3
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v1

code-scanning/properties/dependency-review.properties.json

@@ -0,0 +1,16 @@
+{
+    "name": "Dependency Review",
+    "description": "Scans Pull Requests on each push for the introduction and/or resolution of vulnerable depdendencies to the repository",
+    "iconName": "octicon mark-github",
+    "categories": [
+      "Dependency review",
+      "Dependency graph",
+      "Go",
+      "Java",
+      "JavaScript",
+      "TypeScript",
+      "Python",
+      "Ruby",
+      "Actions",
+      "PHP"]
+}   

script/validate-data/settings.json

@@ -9,6 +9,7 @@
     "Continuous integration",
     "Deployment",
     "Code Scanning",
+    "Dependency review",
     "Automation"
   ]
 }