inteligr8/alfresco-ng2-components
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-ng2-components.git synced 2026-09-09 18:03:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

AAE-47093 Update Supply Chain Review GH AW to latest (#12025)

Browse Source 
[skip ci]
This commit is contained in:
Domenico Sibilio
2026-07-02 11:59:47 +02:00
committed by GitHub
parent 699f45e486
commit af0d1e4ead
3 changed files with 378 additions and 217 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/supply-chain-review.lock.yml
Generated
+372 -183
View File
File diff suppressed because one or more lines are too long
.github/workflows/supply-chain-review.md
+6 -3
View File
@@ -10,7 +10,7 @@ permissions:
engine:
id: copilot
model: gpt-5.4-nano
model: gpt-5-mini
tools:
github:
@@ -30,9 +30,11 @@ safe-outputs:
hide-older-comments: true
add-labels:
allowed: [security:low, security:medium, security:high]
remove-labels:
allowed: [security:low, security:medium, security:high]
submit-pull-request-review:
source: Alfresco/alfresco-build-tools/.github/workflows/supply-chain-review.md@52467f0241079de71fe14591f97bdec7555ab545
source: Alfresco/alfresco-build-tools/.github/workflows/supply-chain-review.md@7479d99410acb8b63f78a5b17abb3b8ebec3a66d
---
# Supply Chain Review
@@ -336,7 +338,8 @@ No suspicious patterns detected. Routine upgrade.
## Step 6 — Apply Label and Review Status
- Apply a label to the PR based on the highest risk level found:
- First, remove any `security:low`, `security:medium`, or `security:high` labels already present on the PR from a previous review — this PR may have been reviewed before (e.g., after a new commit), and stale risk labels must not remain alongside the new one.
- Then apply a label to the PR based on the highest risk level found:
- `security:low` for LOW risk
- `security:medium` for MEDIUM risk
- `security:high` for HIGH or CRITICAL risk