# Dependency Review Action
#
# This Action will scan dependency manifest files that change as part of a Pull Request,
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
# Once installed, if the workflow run is marked as required,
# PRs introducing known-vulnerable packages will be blocked from merging.
#
# Source repository: https://github.com/actions/dependency-review-action
name: 'Dependency Review'
on: [pull_request]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - name: 'Checkout Repository'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          # Semgrep pins mcp==1.29.0 and opentelemetry-api~=1.37.0 exactly
          # (.github/requirements/semgrep.txt), so these cannot be upgraded
          # until Semgrep lifts its pins. They do not apply to our use: CI
          # only runs `semgrep scan` on the checkout and never starts the MCP
          # server (GHSA-84m7-p3x7-pcfv, StreamableHTTP sessions) or parses
          # incoming trace context (GHSA-xcq7-p3pf-p88h, tracestate parsing).
          # Remove the entries once a Semgrep release allows the fixed versions.
          allow-ghsas: GHSA-84m7-p3x7-pcfv, GHSA-xcq7-p3pf-p88h