name: "Dependency Review"
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout Repository"
        uses: actions/checkout@v5

        # Their stupid action rely on PR event metadata, so
        # there is no much sense to setup a re-usable workflow.
      - name: "Dependency Review"
        uses: actions/dependency-review-action@v4
        with:
          config-file: "./.github/dependency-review-config.yml"
