pr_3p_deps.yaml

---
name: 'pr-third-party-deps'
on:
  pull_request:
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true
jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3  # v3.5.0
    - uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c  # v2.5.1
      with:
        # Refer to the following for the allowlist.
        # https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#approved-licenses-for-allowlist
        allow-licenses: >-
          Apache-2.0, BSD-2-Clause, BSD-2-Clause-FreeBSD, BSD-3-Clause,
          MIT, ISC, Python-2.0, PostgreSQL, X11, Zlib