feat(skills): add Terramate migration reference to atmos-migration #14746
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Review | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| dependency-review: | |
| name: Review Dependency Licenses | |
| runs-on: | |
| - runs-on=${{github.run_id}} | |
| - runner=terraform | |
| - tag=atmos | |
| - extras=s3-cache | |
| - private=false | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| # Disable OpenSSF scorecard to reduce summary size (prevents 1024k limit errors) | |
| show-openssf-scorecard: false | |
| # Allow only permissive licenses | |
| # NOTE: GitHub's dependency graph detects Go modules from go.mod automatically | |
| # License checking works at the manifest level for go.mod dependencies | |
| allow-licenses: MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-2-Clause-Views, BSD-3-Clause, ISC, MPL-2.0, 0BSD, Unlicense, CC0-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-3.0, Python-2.0, OFL-1.1, LicenseRef-scancode-generic-cla, LicenseRef-scancode-unknown-license-reference, LicenseRef-scancode-unicode, LicenseRef-scancode-google-patent-license-golang | |
| # Allow specific packages where GitHub cannot detect the license but we've verified it | |
| # github.com/antlr4-go/antlr/v4: BSD-3-Clause (verified at https://github.com/antlr4-go/antlr/blob/master/LICENSE) | |
| # Transitive dependency of github.com/google/cel-go used for CEL `when` expressions | |
| # github.com/google/cel-go: Apache-2.0 (verified at https://github.com/google/cel-go/blob/master/LICENSE) | |
| # Direct dependency used for CEL `when` expressions | |
| # golang.org/x/image: BSD-3-Clause (verified at https://cs.opensource.google/go/x/image/+/v0.43.0:LICENSE) | |
| # Direct dependency used for static cast image rendering | |
| # modernc.org/libc: BSD-3-Clause (verified at https://gitlab.com/cznic/libc/-/blob/master/LICENSE) | |
| # Transitive dependency of modernc.org/sqlite used for AI session storage | |
| # github.com/opencontainers/go-digest: Apache-2.0 code; the "AND CC-BY-SA-4.0" in its | |
| # license scan comes from LICENSE.docs, which covers documentation only (see | |
| # https://github.com/opencontainers/go-digest#copyright-and-license). | |
| # Transitive dependency of github.com/updatecli/updatecli (Version Tracker). | |
| # pako: "MIT AND Zlib" (verified at https://github.com/nodeca/pako/blob/master/LICENSE) - | |
| # MIT-licensed JS wrapper around zlib's permissively-licensed C sources. | |
| # Transitive dependency of @excalidraw/excalidraw (website diagram embeds). | |
| # sax: BlueOak-1.0.0 (verified at https://github.com/isaacs/sax-js/blob/main/LICENSE.md) - | |
| # Blue Oak Model License, a permissive OSS license. | |
| # Transitive dependency of svgo (website SVG optimization). | |
| allow-dependencies-licenses: "pkg:golang/github.com/antlr4-go/antlr/v4, pkg:golang/github.com/google/cel-go, pkg:golang/golang.org/x/image, pkg:golang/modernc.org/libc, pkg:golang/github.com/opencontainers/go-digest, pkg:npm/pako, pkg:npm/sax" | |
| # Fail on moderate or higher severity vulnerabilities | |
| fail-on-severity: moderate | |
| # Temporary allowlist: oras-go v2.6.1 is pulled in by Helm v4.2.1 and is | |
| # currently the latest tagged v2 release. Remove after Helm/ORAS ships a | |
| # fixed version for GHSA-fxhp-mv3v-67qp. | |
| # | |
| # GHSA-mh99-v99m-4gvg (brace-expansion, CVE-2026-14257): the advisory's | |
| # recorded vulnerable range ("<=5.0.7") doesn't distinguish between | |
| # brace-expansion's parallel 1.x/2.x/5.x release lines, so it still flags | |
| # our pinned 1.1.18/2.1.4 even though both contain the same | |
| # EXPANSION_MAX_LENGTH bound backported from the 5.0.8 fix (verified by | |
| # diffing the published tarballs). The only version the advisory | |
| # recognizes as patched, 5.0.8+, is not a safe upgrade here: brace-expansion | |
| # 5.x's CommonJS build changed from a callable default export | |
| # (`module.exports = expand`) to a named export (`exports.expand`), which | |
| # breaks minimatch@3.1.5's `require('brace-expansion')(...)` call | |
| # convention (transitive via serve-handler/@docusaurus/core). | |
| # | |
| # This is a known, already-closed-as-wontfix situation upstream, not | |
| # something fixable from this repo: see isaacs/minimatch#314 and #310. | |
| # The ReDoS fix was backported into brace-expansion's 1.x/2.x lines, but | |
| # minimatch's maintainer declined to bump the older 3.x/5.x/8.x/9.x | |
| # release lines to brace-expansion 5.x, since those lines exist to | |
| # support CJS-only consumers. minimatch's current release (10.2.6) does | |
| # depend on brace-expansion ^5.0.8 (the patched line the advisory | |
| # recognizes), but nothing in our tree can reach it: serve-handler@6.1.7 | |
| # (used by @docusaurus/core for `docusaurus serve`) still hard-pins | |
| # minimatch to 3.1.5, and everything else here resolves minimatch@9.0.9, | |
| # which depends on brace-expansion ^2.0.1. | |
| # | |
| # NOTE: allow-ghsas suppresses this GHSA for every resolved | |
| # brace-expansion version, not just 1.1.18/2.1.4 -- the action has no | |
| # package/version-scoped vulnerability exception (only | |
| # allow-dependencies-licenses is purl-scoped, and that's license-only), | |
| # and dependency-review-action has no SARIF/code-scanning output either, | |
| # so this is the only suppression mechanism it offers -- not a | |
| # workaround chosen over some cleaner supported path. The scoping that | |
| # exists is the exact override values in website/package.json's | |
| # pnpm.overrides (`brace-expansion@^1`/`@^2` selectors pinned to the | |
| # exact "1.1.18"/"2.1.4", not a range). | |
| # | |
| # Remove this entry once either: GHSA-mh99-v99m-4gvg's advisory data is | |
| # corrected to distinguish brace-expansion's 1.x/2.x/5.x release lines | |
| # (see https://github.com/advisories/GHSA-mh99-v99m-4gvg for a | |
| # firstPatchedVersion per major line instead of one "<=5.0.7" range), or | |
| # serve-handler and whatever still depends on minimatch@9.0.9 both move | |
| # to a minimatch version that depends on brace-expansion ^5 -- at that | |
| # point also remove the brace-expansion overrides in | |
| # website/package.json. | |
| allow-ghsas: GHSA-fxhp-mv3v-67qp, GHSA-mh99-v99m-4gvg | |
| # Comment on PR with details | |
| comment-summary-in-pr: always | |
| - name: Generate NOTICE file | |
| run: ./scripts/generate-notice.sh | |
| - name: Check if NOTICE is up to date | |
| run: | | |
| if ! git diff --exit-code NOTICE; then | |
| echo "::error::NOTICE file is out of date. Run './scripts/generate-notice.sh' locally and commit the changes." | |
| exit 1 | |
| fi |