deps.yml

name: "Dependency Review"
on:
  push:
    branches:
      - master
      - 'release-*'
  pull_request:
  workflow_dispatch:
    inputs:
      head_ref:
        description: 'HEAD git reference (tag/branch/commit) to analyze'
        required: true
        default: 'master'
        type: string
      base_ref:
        description: 'Base git reference (tag/branch/commit) to compare against head_ref'
        required: true
        default: 'master'
        type: string
permissions:
  contents: read
jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v4
        with:
          show-progress: false
      - name: "Dependency Review"
        uses: actions/dependency-review-action@v4
        with:
          base-ref: ${{ inputs.base_ref || github.event.pull_request.base.sha || 'master' }}
          head-ref: ${{ inputs.head_ref || github.event.pull_request.head.sha || github.ref }}
  govulncheck:
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v4
        with:
          show-progress: false
      - id: govulncheck
        uses: golang/govulncheck-action@v1
        with:
          go-version-input: 1.22.2
          go-version-file: go.mod
      - id: govulncheck-tests-e2e
        uses: golang/govulncheck-action@v1
        with:
          go-version-input: 1.22.2
          go-version-file: tests/e2e/go.mod