actions/dependency-review-action

Block pull requests that introduce dependencies with known vulnerabilities or bad licenses.

Official actionCategory: Security & Supply ChainLatest v5View on GitHub

What it does

actions/dependency-review-action compares the dependency manifests between a pull request's base and head, then fails the check if the PR introduces packages with known vulnerabilities or disallowed licenses.

It runs on pull_request events and uses the repository's dependency graph, so nothing is installed or executed.

Usage

workflow (.yml)

on: pull_request
permissions:
  contents: read
jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v5
        with:
          fail-on-severity: high

Inputs

Input	Description	Default	Required
`fail-on-severity`	Don't block PRs below this severity: low, moderate, high, critical.	-	No
`allow-licenses`	Comma-separated list of allowed licenses.	-	No
`deny-licenses`	Comma-separated list of forbidden licenses.	-	No
`comment-summary-in-pr`	Post the summary as a PR comment (always or on-failure); needs pull-requests: write.	-	No
`warn-only`	Always complete with success, overriding fail-on-severity.	-	No
`config-file`	Path to a configuration file for the action.	-	No
`repo-token`	Token for the repository.	`${{ github.token }}`	No

Outputs

Output	Description
`dependency-changes`	All dependency changes (JSON).
`vulnerable-changes`	Vulnerable dependency changes (JSON).
`invalid-license-changes`	Invalid license dependency changes (JSON).

Notes

The repository must have the dependency graph enabled (on by default for public repos; private repos need it turned on in settings, and GitHub Advanced Security where applicable).

Outside pull_request/pull_request_target events you must pass base-ref and head-ref explicitly.

Setting comment-summary-in-pr to always or on-failure requires pull-requests: write on the job.

Common errors

Dependency review is not supported on this repository means the dependency graph is disabled for the repo. Enable it under Settings before the check can run.
A failure about missing base/head refs means the workflow ran on a non-PR event (e.g. push) without providing base-ref and head-ref.

Security and pinning

The default GITHUB_TOKEN with contents: read is enough for the basic check; only add pull-requests: write if you enable the PR comment.
Use allow-ghsas sparingly and per-advisory rather than lowering fail-on-severity for everyone.

Alternatives and related

aquasecurity/trivy-actionScan container images, filesystems, and IaC for vulnerabilities with Trivy. github/codeql-actionRun GitHub CodeQL static analysis to find security vulnerabilities in your code.

Frequently asked questions

Why does the action do nothing on push builds?

It is a PR-diff check: it needs a base and head to compare. Run it on pull_request, or pass base-ref/head-ref yourself for other events.

Can it warn without blocking merges?

Yes. Set warn-only: true and the check always succeeds while still reporting findings, which is a common way to trial a policy before enforcing it.

References

GitHub Actions documentation