19 lines
554 B
YAML
19 lines
554 B
YAML
# GitHub dependency-review configuration. The workflow guards this GitHub-only API so other forges
|
|
# use the platform-neutral Trivy filesystem snapshot instead.
|
|
fail-on-severity: high
|
|
|
|
fail-on-scopes:
|
|
- runtime
|
|
|
|
# Template legal posture: deny strong and network copyleft for newly introduced dependencies.
|
|
# Forks must have their legal/security owner review this organization-specific list.
|
|
deny-licenses:
|
|
- GPL-2.0-only
|
|
- GPL-2.0-or-later
|
|
- GPL-3.0-only
|
|
- GPL-3.0-or-later
|
|
- AGPL-3.0-only
|
|
- AGPL-3.0-or-later
|
|
|
|
comment-summary-in-pr: never
|