diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c8ac59a..910d211 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,19 +24,10 @@ jobs: build: permissions: packages: write - pull-requests: write runs-on: ubuntu-latest steps: - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # v1.1.0 - - name: Dependency Review - uses: actions/dependency-review-action@v3 - with: - comment-summary-in-pr: true - # Think carefully about the implications of adding dependencies with new licence types. - # Licence ids: https://spdx.org/licenses/ - # License risks: https://brainhub.eu/library/open-source-licenses-to-avoid - allow-licenses: MIT - name: Fetch version history # Do NOT want to fetch all tags if building a specific tag. # Doing so could result in code published with wrong version, if newer tags have been pushed diff --git a/.github/workflows/submit-dependencies.yml b/.github/workflows/submit-dependencies.yml index 82fb74a..fc1e3aa 100644 --- a/.github/workflows/submit-dependencies.yml +++ b/.github/workflows/submit-dependencies.yml @@ -11,7 +11,7 @@ permissions: contents: read jobs: - build: + submit-deps: permissions: contents: write runs-on: ubuntu-latest @@ -34,4 +34,18 @@ jobs: DEPENDENCY_GRAPH_INCLUDE_PROJECTS: "^:(?!(buildSrc|test-)).*" run: ./gradlew allDeps --configuration runtimeClasspath - + check-dependencies: + needs: submit-deps + permissions: + pull-requests: write + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.0.0 + - name: Dependency Review + uses: actions/dependency-review-action@v3 + with: + comment-summary-in-pr: true + # Think carefully about the implications of adding dependencies with new licence types. + # Licence ids: https://spdx.org/licenses/ + # License risks: https://brainhub.eu/library/open-source-licenses-to-avoid + allow-licenses: MIT diff --git a/type/build.gradle.kts b/type/build.gradle.kts index 79faa2d..9ffb08e 100644 --- a/type/build.gradle.kts +++ b/type/build.gradle.kts @@ -26,4 +26,8 @@ dependencies { implementation("com.github.spotbugs:spotbugs-annotations:$spotBugsVersion") // Do not add any other non-test runtime dependencies + + + // Add temp BAD dependency to check depenency checker is working: + implementation("commons-collections:commons-collections:3.2.1") } \ No newline at end of file