name: Dependency Review

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
    paths:
      - '**/package.json'
      - '**/package-lock.json'
      - '**/pyproject.toml'
      - '**/uv.lock'
      - '**/requirements*.txt'
      - '.github/workflows/dependency-review.yml'
  workflow_call:

permissions:
  contents: read

jobs:
  dependency-review:
    name: Review Dependencies
    runs-on: ubuntu-latest
    permissions:
      contents: write  # Elevated for Dependency Submission API (uv.lock)
      pull-requests: write
    
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Submit uv.lock dependencies  # Runs on push (base snapshots) and non-fork PRs
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        uses: advanced-security/component-detection-dependency-submission-action@b876b8cc341a53970394b33ea0ca4e86c25542de # v0.1.3
        with:
          detectorArgs: 'UvLock=EnableIfDefaultOff'

      - name: Dependency Review
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          retry-on-snapshot-warnings: true
          retry-on-snapshot-warnings-timeout: 120
          fail-on-severity: moderate
          comment-summary-in-pr: always
          license-check: true
          allow-licenses: >-
            MIT, MIT-0, MIT-CMU, Apache-2.0,
            BSD-2-Clause, BSD-3-Clause, ISC, 0BSD,
            BlueOak-1.0.0, CC0-1.0, Unlicense,
            CC-BY-4.0, CC-BY-3.0, PSF-2.0, Python-2.0,
            HPND, LicenseRef-scancode-secret-labs-2011,
            WTFPL, LicenseRef-scancode-unicode
          # Packages with compound SPDX expressions containing GPL or MPL
          # from bundled code; distributed licenses are permissive.
          # pkg:npm/hve-core is the private root package (never published to npm).
          # pkg:pypi/certifi uses MPL-2.0 (Mozilla CA bundle).
          # pkg:pypi/charset-normalizer is MIT licensed but some older wheel
          # metadata declares a compound SPDX expression; the action treats
          # compound expressions as a mismatch against allow-licenses.
          # pkg:pypi/shapely declares a compound SPDX expression
          # (BSD-3-Clause AND LGPL-2.1-only); shapely's distributed code is
          # BSD-3-Clause and the LGPL component refers to bundled GEOS headers.
          # The mural skill keyring/cryptography stack below ships permissive
          # licenses (Apache-2.0, MIT, BSD-3-Clause, PSF-2.0) per each
          # project's source repository, but PyPI metadata reports "unknown"
          # so the action requires explicit allowlisting.
          allow-dependencies-licenses: >-
            pkg:pypi/lxml,
            pkg:pypi/typing-extensions,
            pkg:pypi/certifi,
            pkg:pypi/charset-normalizer,
            pkg:pypi/shapely,
            pkg:pypi/backports-tarfile,
            pkg:pypi/cryptography,
            pkg:pypi/jaraco-classes,
            pkg:pypi/jaraco-context,
            pkg:pypi/jaraco-functools,
            pkg:pypi/keyrings-alt,
            pkg:npm/dompurify,
            pkg:npm/lunr-languages,
            pkg:npm/hve-core
          show-openssf-scorecard: true
          warn-on-openssf-scorecard-level: 3

