Repository navigation
[DO NOT REVIEW] microVM: remove portb's host input #7121
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependency Review — checks for external (3rd-party) crate changes in | ||
|
Check warning on line 1 in .github/workflows/dep-review.yml
|
||
| # Cargo.lock and conditionally requests review from the dependency team. | ||
| # | ||
| # Replaces the blunt CODEOWNERS gate on Cargo.lock. Internal-only lockfile | ||
| # changes (adding/removing workspace crates) don't trigger a review request. | ||
| # External dependency additions or version bumps, and containment policy | ||
| # violations, cause the workflow to request review from | ||
| # @microsoft/openvmm-dependency-reviewers. If no issues are detected (or | ||
| # they're resolved), the review request is removed. | ||
| # | ||
| # SECURITY NOTE: This workflow uses pull_request_target so it can manage | ||
| # review requests. To avoid executing untrusted code, it checks out the | ||
| # BASE branch only (not the PR branch) and runs the script from there. | ||
| # All PR file contents are fetched via the GitHub API. | ||
| name: "Dependency Review" | ||
| on: | ||
| pull_request_target: | ||
| types: [opened, synchronize, reopened] | ||
| concurrency: | ||
| group: dep-review-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: true | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| jobs: | ||
| dep-review: | ||
| if: github.repository == 'microsoft/openvmm' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout base branch (safe — our own code) | ||
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | ||
| with: | ||
| sparse-checkout: | | ||
| .github/scripts | ||
| .github/dep-policy.json | ||
| sparse-checkout-cone-mode: false | ||
| - name: Review Cargo.lock changes | ||
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 | ||
| with: | ||
| script: | | ||
| const { run } = require('./.github/scripts/dep-review.js'); | ||
| await run(github, context, core); | ||
