mirror of
https://github.com/sbroenne/mcp-server-excel.git
synced 2026-09-19 07:53:08 +08:00
Stefan Broenner
a67212a278
* chore(deps): update all dependencies Updates NuGet, npm, Python, the .NET SDK, VS Code tooling, and GitHub Actions. Tests: Release build; MCP protocol and transport tests; extension compile and lint; documentation build; package vulnerability audits. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5e3452df-35bd-418d-b1f4-8b6903f8df24 * ci: allow verified Python package licenses Allows MIT-0 and PSF-2.0 dependencies and scopes the typing-extensions metadata exception to that package. Tests: dependency workflow YAML parse; full pre-commit gates. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5e3452df-35bd-418d-b1f4-8b6903f8df24 --------- Copilot-Session: 5e3452df-35bd-418d-b1f4-8b6903f8df24
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
# Dependency Review Workflow
|
|
# Scans pull requests for vulnerable dependencies before merging
|
|
|
|
name: 'Dependency Review'
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [ "main", "develop" ]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
dependency-review:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@v5
|
|
with:
|
|
# Fail the build if vulnerabilities are found
|
|
fail-on-severity: moderate
|
|
|
|
# Fail if GPL/AGPL/LGPL licenses detected; allow common permissive/OSI-approved licenses
|
|
license-check: true
|
|
# Python-2.0 and PSF-2.0 are OSI-approved Python ecosystem licenses.
|
|
# MIT-0 is the permissive MIT variant used by cffi.
|
|
allow-licenses: MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, LicenseRef-scancode-generic-cla, BlueOak-1.0.0, CC0-1.0, MPL-2.0, Python-2.0, PSF-2.0
|
|
|
|
# PyPI declares typing-extensions as PSF-2.0, but dependency review
|
|
# currently reports a composite expression containing vendored licenses.
|
|
allow-dependencies-licenses: "pkg:pypi/typing-extensions"
|
|
|
|
# Comment on PR with summary
|
|
comment-summary-in-pr: always
|
|
|
|
# Show vulnerabilities by severity
|
|
warn-only: false
|
|
|
|
# Block critical and high severity vulnerabilities
|
|
fail-on-scopes: runtime, development
|
|
|
|
# Additional configuration
|
|
base-ref: ${{ github.event.pull_request.base.sha }}
|
|
head-ref: ${{ github.event.pull_request.head.sha }}
|
|
|
|
# Known unfixable transitive vulnerabilities in dev-only build tools
|
|
# minimatch@3.x ReDoS in @vscode/vsce (no fix available upstream)
|
|
allow-ghsas: GHSA-3ppc-4f35-3m26
|
|
|
|
- name: Dependency Review Summary
|
|
if: always()
|
|
run: |
|
|
echo "✅ Dependency review completed"
|
|
echo "Review results are available in the Security tab"
|