What is the best way to ensure that added dependencies' licenses are checked and new code is analyzed at the repository level?

The correct answer is A. Configure a workflow with the dependency review action. The dependency review action, used inside a GitHub Actions workflow, can enforce license policies and block PRs that add dependencies with disallowed licenses, in addition to flagging known vulnerabilities. It operates at the repository level as an automated CI check. Secret…

Configure and use Dependabot and Dependency Review

Question

What is the best way to ensure that added dependencies’ licenses are checked and new code is analyzed at the repository level?

Options

AConfigure a workflow with the dependency review action.
BEnable secret scanning.
CConfigure Require status checks to pass with a CodeQL action in a repository Ruleset.
DConfigure Dependabot.

How the community answered

(33 responses)

A
91% (30)
B
3% (1)
C
6% (2)

Explanation

The dependency review action, used inside a GitHub Actions workflow, can enforce license policies and block PRs that add dependencies with disallowed licenses, in addition to flagging known vulnerabilities. It operates at the repository level as an automated CI check. Secret scanning (B) finds exposed credentials, not licenses or code quality issues. A CodeQL action in a Ruleset (C) focuses on static code analysis for security vulnerabilities, not license compliance. Dependabot (D) alerts on vulnerability advisories for existing dependencies but does not perform license checking or code analysis.

Topics

#Dependency Review#Dependency Management#License Checking#GitHub Actions

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice