dependency-review-action

Tech stack & purpose

dependency-review-action is a GitHub Action built in TypeScript and Node.js that scans pull requests for dependency changes, raising errors if vulnerabilities or invalid licenses are introduced. It queries the GitHub Dependency Review API to evaluate changes against configured rules for severity thresholds, license compliance, and package restrictions, and produces job summaries and PR comments with the results. The action is maintained by GitHub and supports both standard public and private repositories with GitHub Advanced Security, as well as GitHub Enterprise Server deployments.

Languages

Contributors (top 30 of 64)

• Federico Builes785 commits
• 
  dependabot[bot]440 commits · 0 followers
• Justin Holguín75 commits
• Justin Hutchings63 commits
• cnagadya59 commits
• Eli Reisman45 commits
• Kevin Dangoor36 commits
• 
  Josh Soref34 commits · 784 followers
• Jon Janego30 commits
• Eric Sorenson30 commits
• Henri Maurer28 commits
• tgrall24 commits
• Barry Gordon23 commits
• Sarah Aladetan22 commits
• Ahmed ElMallah21 commits
• Stefan Petrushevski19 commits
• Claire Song19 commits
• Brandon Teng17 commits
• David Losert16 commits
• Kenichi Kamiya15 commits
• Ashely Tenesaca15 commits
• Adrien Pessu12 commits
• Courtney Claessens12 commits
• Roman Iakovlev11 commits
• laughedelic11 commits
• Anne-Marie11 commits
• Lewis Jones9 commits
• ahmed3lmallah8 commits
• Chad Bentz8 commits
• Lane Seppala8 commits