# GitHub dependency-review configuration. The workflow guards this GitHub-only API so other forges
# use the platform-neutral Trivy filesystem snapshot instead.
fail-on-severity: high

fail-on-scopes:
  - runtime

# Template legal posture: deny strong and network copyleft for newly introduced dependencies.
# Forks must have their legal/security owner review this organization-specific list.
deny-licenses:
  - GPL-2.0-only
  - GPL-2.0-or-later
  - GPL-3.0-only
  - GPL-3.0-or-later
  - AGPL-3.0-only
  - AGPL-3.0-or-later

comment-summary-in-pr: never