Modernize dependency review workflow configuration

[hspaans]

This pull request updates the .github/workflows/dependency-review.yml GitHub Actions workflow to improve dependency review enforcement and configuration. The changes modernize the workflow, enhance documentation, and provide more granular control over license and dependency policies.

Workflow improvements and configuration:

• Added detailed documentation and comments to clarify the purpose and configuration options of the Dependency Review Action, including links to relevant documentation.
• Changed the workflow name to 'Dependency review' and updated the trigger to use a more concise branch specification.
• Updated permissions to include pull-requests: write, enabling features like commenting summaries directly in pull requests.
• Enhanced the workflow steps with more descriptive names and updated the actions/checkout and actions/dependency-review-action versions.
• Switched from a deny-list approach (deny-licenses) to an allow-list (allow-licenses), specifying approved licenses, and enabled always posting a comment summary in PRs. Also, added an example for allow-dependencies-licenses.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

🟡 Changes recommended

The allow-dependencies-licenses purl uses an invalid type so the option silently does nothing, and the new allow-licenses allow-list omits common Python permissive licenses (BSD/ISC), which can block legitimate dependency updates.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR modernizes .github/workflows/dependency-review.yml, replacing the previous minimal configuration with the current GitHub starter-workflow template plus project-specific license policy. It documents the action with explanatory comments, adds pull-requests: write permission to allow posting a summary comment, and shifts the license policy from a small deny-list to an allow-list.

Changes:

• Reworked the workflow to always post a dependency-review summary comment in PRs (comment-summary-in-pr: always) and granted the required pull-requests: write permission.
• Replaced deny-licenses: AGPL-1.0-or-later with an allow-licenses allow-list and added an allow-dependencies-licenses entry.
• Added documentation comments, renamed the workflow/steps, and reformatted the branch trigger (semantically still master).

Note: the PR description states the actions/checkout and actions/dependency-review-action versions were updated, but in the diff those uses: lines (v7 and v5) are unchanged context lines, so no version bump actually occurred.

File summaries

File	Description
.github/workflows/dependency-review.yml	Adds template documentation/comments, pull-requests: write permission, PR summary comments, and switches license enforcement from a deny-list to an allow-list plus an allow-dependencies-licenses example.

Review details

Suppressed comments (1)

.github/workflows/dependency-review.yml:40

• The allow-dependencies-licenses value pkg:actions/dependency-review-action is not a valid package URL. The purl type for GitHub Actions is githubactions, so a valid purl would look like pkg:githubactions/actions/dependency-review-action. As written (type actions), it will not match any scanned dependency, so this option has no effect. Additionally, the dependency-review-action is a workflow action rather than a scanned project dependency, so allow-listing it here is likely unnecessary. If this line was only meant as a template example, consider removing it or commenting it out.

          allow-dependencies-licenses: "pkg:actions/dependency-review-action"

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Line 16 introduces trailing whitespace that will fail the repo-wide yamllint CI job, and the license allow-list plus the invalid allow-dependencies-licenses PURL need correction.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/dependency-review.yml:42

• pkg:actions/dependency-review-action is not a valid Package URL. The allow-dependencies-licenses option expects purls whose first segment is the ecosystem type (e.g. pkg:pypi/..., pkg:npm/...). GitHub Actions are tracked in the dependency graph under the githubactions type, so actions is not a recognized purl type and this value will not match the action. To exclude the action from the license check, use the githubactions type.

.github/workflows/dependency-review.yml:41

• Switching from deny-licenses to allow-licenses makes this a strict allow-list: every license found in scanned dependencies must appear here, otherwise the check fails. This list omits licenses that are very common in the Python ecosystem and are used by this project's own dev dependencies — for example BSD-2-Clause/BSD-3-Clause (Sphinx, Pygments, Jinja2, colorama), the PSF license, and GPL-3.0-or-later (yamllint is GPL-3.0-or-later, but only GPL-2.0-or-later is allowed here). At the same time it allows documentation-oriented licenses (GFDL-1.1-or-later, CC-BY-4.0, CC-BY-SA-4.0) that are unusual for code dependencies, which suggests the list may have been copied from an unrelated project. As a result, routine PRs that add or bump these dependencies would fail dependency review. Consider aligning the allowed set with the licenses actually used by this project's dependencies (or keeping a deny-list) so the gate reflects the intended policy.

          allow-licenses: GPL-2.0-or-later, LGPL-2.1-or-later, GFDL-1.1-or-later, MIT, MPL-2.0, CC-BY-4.0, CC-BY-SA-4.0, Apache-2.0

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

🔵 Needs a closer look

The allow-dependencies-licenses purl uses an invalid ecosystem type (actions instead of githubactions) so the exemption is a no-op, and the allow-licenses list omits licenses used by the project's own dependencies (e.g. Sphinx/BSD-2-Clause, yamllint/GPL-3.0-only), which will fail legitimate updates.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/dependency-review.yml:42

• The purl in allow-dependencies-licenses is malformed. GitHub represents Actions dependencies with the purl type githubactions, so the value must be pkg:githubactions/<owner>/<repo> (e.g. pkg:githubactions/actions/dependency-review-action). The current value pkg:actions/dependency-review-action uses actions as the purl type, which is not a recognized ecosystem, so it will never match the intended dependency and the exemption silently has no effect.

.github/workflows/dependency-review.yml:41

• Switching to a strict allow-licenses allow-list will block dependency updates whose license is not explicitly listed, and this list omits licenses used by the project's own dev dependencies. For example, Sphinx is BSD-2-Clause and yamllint is GPL-3.0-only (the list only allows GPL-2.0-or-later), and common permissive licenses like BSD-3-Clause and ISC — pervasive in the Python ecosystem — are also missing. As a result, routine bumps of these packages will fail the Dependency Review check. Consider adding the permissive/copyleft licenses actually present in the dependency tree (e.g. BSD-2-Clause, BSD-3-Clause, ISC, GPL-3.0-only), or keeping the previous deny-list approach.

          allow-licenses: GPL-2.0-or-later, LGPL-2.1-or-later, GFDL-1.1-or-later, MIT, MPL-2.0, CC-BY-4.0, CC-BY-SA-4.0, Apache-2.0

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Balanced