Add/dependency check #81
Conversation
See historical rationale for these specific licenses: - 10up/.github#24 - 10up/.github#26 - 10up/.github#27
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
Noted this on the other workflow PR but the approach we've taken so far is to disable all permissions at the workflow level and then add proper permissions at the job level. So I think just need to change this to permissions: {} and then move this block to the dependency-review job
Updated the dependency review workflow to disable default permissions and added specific permissions for the job.
Co-authored-by: Darin Kotter <darin.kotter@gmail.com>
Ideally we merge #78 first and then I can rebase this PR from
trunkto get the readme badge properly aligned.What?
Relates to #28.
This pull request introduces automated dependency license checking to the project by adding configuration and workflow files for GitHub's Dependency Review Action. It ensures that only GPL-compatible licenses are allowed in dependencies, aligning with open source compliance requirements. Additionally, a status badge is added to the
README.mdto indicate the status of the dependency review workflow.Dependency review automation:
.github/dependency-review-config.ymlto enforce a strict allow-list of GPL-compatible licenses for all dependencies, based on the FSF's official list..github/workflows/dependency-review.ymlworkflow to automatically check new or updated dependencies in pull requests for license compliance using GitHub's Dependency Review Action.Documentation:
README.mdto include a badge displaying the status of the new dependency review workflow.Why?
How?
Note that the background on the specific licenses noted in the config file are described here (which generally pulled from prior work in the Gutenberg plugin)
Apache-2.0 AND Apache-2.0 WITH LLVM-exceptionto allow-licenses 10up/.github#27Testing Instructions
Testing Instructions for Keyboard
Screenshots or screencast
Test using WordPress Playground
The changes in this pull request can be previewed and tested using this WordPress Playground instance:
Click here to test this pull request.