chore(deps): remove expired quarantine excludes #227
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| if: github.event.pull_request.draft != true | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Dependency Review | |
| # License allow-list mirrors deny.toml; keep the two in sync. | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| fail-on-scopes: runtime, development, unknown | |
| allow-licenses: >- | |
| MIT, | |
| Apache-2.0, | |
| Apache-2.0 WITH LLVM-exception, | |
| BSD-2-Clause, | |
| BSD-3-Clause, | |
| ISC, | |
| 0BSD, | |
| BlueOak-1.0.0, | |
| Unlicense, | |
| CC0-1.0, | |
| CC-BY-4.0, | |
| MIT-0, | |
| MPL-2.0, | |
| Python-2.0, | |
| Zlib, | |
| Unicode-3.0 | |
| # libfuzzer-sys (fuzz/ crate) is dual MIT/Apache-2.0 AND NCSA; NCSA is | |
| # not on the SPDX allow-list above. It is a build-only fuzzing | |
| # dependency, never shipped, so allow it explicitly by package. | |
| allow-dependencies-licenses: >- | |
| pkg:cargo/libfuzzer-sys | |
| comment-summary-in-pr: always |