Dependency review as policy: make vulnerable package changes fail visibly addresses one concrete problem: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. The guide works from the actual objects — dependency review, GitHub Actions, vulnerability, license, pull request — and aims for a verifiable decision rather than a generic pattern.
The concrete problem: dependency review meets GitHub Actions
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c11 starts at license and treats pull request as an explicit boundary rather than an implicit assumption. The first control requires dependency review to emit an observable result before GitHub Actions can trigger the intended effect around vulnerability. To test pull request, fixture dependency-review-policy-gate-c11 contains both an allowed state and a rejected state; rejection must occur before any change attributed to dependency review. Operations then observes the transition between dependency review and GitHub Actions, while security checks that vulnerability receives neither implicit authority nor unnecessary data. If the GitHub Actions verification fails, rollback restores the configuration around vulnerability, replays dependency-review-policy-gate-c11, and compares the new state with the control evidence from license.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c12 starts at pull request and treats dependency review as an explicit boundary rather than an implicit assumption. The first control requires GitHub Actions to emit an observable result before vulnerability can trigger the intended effect around license. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to dependency review, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by GitHub Actions and license: anything not demonstrated by scenario dependency-review-policy-gate-c12 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns pull request into a reviewable decision point with a named input and a retained output.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c13 starts at dependency review and treats GitHub Actions as an explicit boundary rather than an implicit assumption. The first control requires vulnerability to emit an observable result before license can trigger the intended effect around pull request. To test GitHub Actions, fixture dependency-review-policy-gate-c13 contains both an allowed state and a rejected state; rejection must occur before any change attributed to vulnerability. Operations then observes the transition between vulnerability and license, while security checks that pull request receives neither implicit authority nor unnecessary data. If the license verification fails, rollback restores the configuration around pull request, replays dependency-review-policy-gate-c13, and compares the new state with the control evidence from dependency review.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c14 starts at GitHub Actions and treats vulnerability as an explicit boundary rather than an implicit assumption. The first control requires license to emit an observable result before pull request can trigger the intended effect around dependency review. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to vulnerability, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by license and dependency review: anything not demonstrated by scenario dependency-review-policy-gate-c14 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns GitHub Actions into a reviewable decision point with a named input and a retained output.
Failure modes, signals, and diagnosis
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c21 starts at pull request and treats dependency review as an explicit boundary rather than an implicit assumption. The first control requires GitHub Actions to emit an observable result before vulnerability can trigger the intended effect around license. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns pull request into a reviewable decision point with a named input and a retained output. To test dependency review, fixture dependency-review-policy-gate-c21 contains both an allowed state and a rejected state; rejection must occur before any change attributed to GitHub Actions. Operations then observes the transition between GitHub Actions and vulnerability, while security checks that license receives neither implicit authority nor unnecessary data.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c22 starts at dependency review and treats GitHub Actions as an explicit boundary rather than an implicit assumption. The first control requires vulnerability to emit an observable result before license can trigger the intended effect around pull request. If the license verification fails, rollback restores the configuration around pull request, replays dependency-review-policy-gate-c22, and compares the new state with the control evidence from dependency review. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to GitHub Actions, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by vulnerability and pull request: anything not demonstrated by scenario dependency-review-policy-gate-c22 is labeled as a limitation or inference, never promoted to fact.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c23 starts at GitHub Actions and treats vulnerability as an explicit boundary rather than an implicit assumption. The first control requires license to emit an observable result before pull request can trigger the intended effect around dependency review. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns GitHub Actions into a reviewable decision point with a named input and a retained output. To test vulnerability, fixture dependency-review-policy-gate-c23 contains both an allowed state and a rejected state; rejection must occur before any change attributed to license. Operations then observes the transition between license and pull request, while security checks that dependency review receives neither implicit authority nor unnecessary data.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c24 starts at vulnerability and treats license as an explicit boundary rather than an implicit assumption. The first control requires pull request to emit an observable result before dependency review can trigger the intended effect around GitHub Actions. If the dependency review verification fails, rollback restores the configuration around GitHub Actions, replays dependency-review-policy-gate-c24, and compares the new state with the control evidence from vulnerability. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to license, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by pull request and GitHub Actions: anything not demonstrated by scenario dependency-review-policy-gate-c24 is labeled as a limitation or inference, never promoted to fact.
Progressive rollout and rollback
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c31 starts at dependency review and treats GitHub Actions as an explicit boundary rather than an implicit assumption. The first control requires vulnerability to emit an observable result before license can trigger the intended effect around pull request. The conclusion stays bounded by vulnerability and pull request: anything not demonstrated by scenario dependency-review-policy-gate-c31 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns dependency review into a reviewable decision point with a named input and a retained output. To test GitHub Actions, fixture dependency-review-policy-gate-c31 contains both an allowed state and a rejected state; rejection must occur before any change attributed to vulnerability.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c32 starts at GitHub Actions and treats vulnerability as an explicit boundary rather than an implicit assumption. The first control requires license to emit an observable result before pull request can trigger the intended effect around dependency review. Operations then observes the transition between license and pull request, while security checks that dependency review receives neither implicit authority nor unnecessary data. If the pull request verification fails, rollback restores the configuration around dependency review, replays dependency-review-policy-gate-c32, and compares the new state with the control evidence from GitHub Actions. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to vulnerability, a concrete condition, and evidence instead of a generic assurance.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c33 starts at vulnerability and treats license as an explicit boundary rather than an implicit assumption. The first control requires pull request to emit an observable result before dependency review can trigger the intended effect around GitHub Actions. The conclusion stays bounded by pull request and GitHub Actions: anything not demonstrated by scenario dependency-review-policy-gate-c33 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns vulnerability into a reviewable decision point with a named input and a retained output. To test license, fixture dependency-review-policy-gate-c33 contains both an allowed state and a rejected state; rejection must occur before any change attributed to pull request.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c34 starts at license and treats pull request as an explicit boundary rather than an implicit assumption. The first control requires dependency review to emit an observable result before GitHub Actions can trigger the intended effect around vulnerability. Operations then observes the transition between dependency review and GitHub Actions, while security checks that vulnerability receives neither implicit authority nor unnecessary data. If the GitHub Actions verification fails, rollback restores the configuration around vulnerability, replays dependency-review-policy-gate-c34, and compares the new state with the control evidence from license. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to pull request, a concrete condition, and evidence instead of a generic assurance.
- Step 1 — Configure dependency review, run verification
dependency-review-policy-gate-step-1, and retain the observable result before continuing. - Step 2 — Configure GitHub Actions, run verification
dependency-review-policy-gate-step-2, and retain the observable result before continuing. - Step 3 — Configure vulnerability, run verification
dependency-review-policy-gate-step-3, and retain the observable result before continuing. - Step 4 — Configure license, run verification
dependency-review-policy-gate-step-4, and retain the observable result before continuing. - Step 5 — Configure pull request, run verification
dependency-review-policy-gate-step-5, and retain the observable result before continuing. - Step 6 — Configure dependency review, run verification
dependency-review-policy-gate-step-6, and retain the observable result before continuing.
Three failures and fixes
- Input rejected after the side effect: move validation before external execution.
- Missing evidence: log a decision identifier without the secret payload.
- Partial rollback: restore both configuration and authorization, then replay the control fixture.
Production decision criteria
The starting point is not a feature; it is an observable decision boundary.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c41 starts at GitHub Actions and treats vulnerability as an explicit boundary rather than an implicit assumption. The first control requires license to emit an observable result before pull request can trigger the intended effect around dependency review. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to vulnerability, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by license and dependency review: anything not demonstrated by scenario dependency-review-policy-gate-c41 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns GitHub Actions into a reviewable decision point with a named input and a retained output.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c42 starts at vulnerability and treats license as an explicit boundary rather than an implicit assumption. The first control requires pull request to emit an observable result before dependency review can trigger the intended effect around GitHub Actions. To test license, fixture dependency-review-policy-gate-c42 contains both an allowed state and a rejected state; rejection must occur before any change attributed to pull request. Operations then observes the transition between pull request and dependency review, while security checks that GitHub Actions receives neither implicit authority nor unnecessary data. If the dependency review verification fails, rollback restores the configuration around GitHub Actions, replays dependency-review-policy-gate-c42, and compares the new state with the control evidence from vulnerability.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c43 starts at license and treats pull request as an explicit boundary rather than an implicit assumption. The first control requires dependency review to emit an observable result before GitHub Actions can trigger the intended effect around vulnerability. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to pull request, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by dependency review and vulnerability: anything not demonstrated by scenario dependency-review-policy-gate-c43 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns license into a reviewable decision point with a named input and a retained output.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c44 starts at pull request and treats dependency review as an explicit boundary rather than an implicit assumption. The first control requires GitHub Actions to emit an observable result before vulnerability can trigger the intended effect around license. To test dependency review, fixture dependency-review-policy-gate-c44 contains both an allowed state and a rejected state; rejection must occur before any change attributed to GitHub Actions. Operations then observes the transition between GitHub Actions and vulnerability, while security checks that license receives neither implicit authority nor unnecessary data. If the vulnerability verification fails, rollback restores the configuration around license, replays dependency-review-policy-gate-c44, and compares the new state with the control evidence from pull request.
Trust boundaries around vulnerability
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c51 starts at vulnerability and treats license as an explicit boundary rather than an implicit assumption. The first control requires pull request to emit an observable result before dependency review can trigger the intended effect around GitHub Actions. If the dependency review verification fails, rollback restores the configuration around GitHub Actions, replays dependency-review-policy-gate-c51, and compares the new state with the control evidence from vulnerability. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to license, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by pull request and GitHub Actions: anything not demonstrated by scenario dependency-review-policy-gate-c51 is labeled as a limitation or inference, never promoted to fact.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c52 starts at license and treats pull request as an explicit boundary rather than an implicit assumption. The first control requires dependency review to emit an observable result before GitHub Actions can trigger the intended effect around vulnerability. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns license into a reviewable decision point with a named input and a retained output. To test pull request, fixture dependency-review-policy-gate-c52 contains both an allowed state and a rejected state; rejection must occur before any change attributed to dependency review. Operations then observes the transition between dependency review and GitHub Actions, while security checks that vulnerability receives neither implicit authority nor unnecessary data.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c53 starts at pull request and treats dependency review as an explicit boundary rather than an implicit assumption. The first control requires GitHub Actions to emit an observable result before vulnerability can trigger the intended effect around license. If the vulnerability verification fails, rollback restores the configuration around license, replays dependency-review-policy-gate-c53, and compares the new state with the control evidence from pull request. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to dependency review, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by GitHub Actions and license: anything not demonstrated by scenario dependency-review-policy-gate-c53 is labeled as a limitation or inference, never promoted to fact.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c54 starts at dependency review and treats GitHub Actions as an explicit boundary rather than an implicit assumption. The first control requires vulnerability to emit an observable result before license can trigger the intended effect around pull request. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns dependency review into a reviewable decision point with a named input and a retained output. To test GitHub Actions, fixture dependency-review-policy-gate-c54 contains both an allowed state and a rejected state; rejection must occur before any change attributed to vulnerability. Operations then observes the transition between vulnerability and license, while security checks that pull request receives neither implicit authority nor unnecessary data.
Prepare the starting state and prerequisites
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c61 starts at license and treats pull request as an explicit boundary rather than an implicit assumption. The first control requires dependency review to emit an observable result before GitHub Actions can trigger the intended effect around vulnerability. Operations then observes the transition between dependency review and GitHub Actions, while security checks that vulnerability receives neither implicit authority nor unnecessary data. If the GitHub Actions verification fails, rollback restores the configuration around vulnerability, replays dependency-review-policy-gate-c61, and compares the new state with the control evidence from license. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to pull request, a concrete condition, and evidence instead of a generic assurance.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c62 starts at pull request and treats dependency review as an explicit boundary rather than an implicit assumption. The first control requires GitHub Actions to emit an observable result before vulnerability can trigger the intended effect around license. The conclusion stays bounded by GitHub Actions and license: anything not demonstrated by scenario dependency-review-policy-gate-c62 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns pull request into a reviewable decision point with a named input and a retained output. To test dependency review, fixture dependency-review-policy-gate-c62 contains both an allowed state and a rejected state; rejection must occur before any change attributed to GitHub Actions.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c63 starts at dependency review and treats GitHub Actions as an explicit boundary rather than an implicit assumption. The first control requires vulnerability to emit an observable result before license can trigger the intended effect around pull request. Operations then observes the transition between vulnerability and license, while security checks that pull request receives neither implicit authority nor unnecessary data. If the license verification fails, rollback restores the configuration around pull request, replays dependency-review-policy-gate-c63, and compares the new state with the control evidence from dependency review. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to GitHub Actions, a concrete condition, and evidence instead of a generic assurance.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c64 starts at GitHub Actions and treats vulnerability as an explicit boundary rather than an implicit assumption. The first control requires license to emit an observable result before pull request can trigger the intended effect around dependency review. The conclusion stays bounded by license and dependency review: anything not demonstrated by scenario dependency-review-policy-gate-c64 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns GitHub Actions into a reviewable decision point with a named input and a retained output. To test vulnerability, fixture dependency-review-policy-gate-c64 contains both an allowed state and a rejected state; rejection must occur before any change attributed to license.
Execute the procedure and observe the result
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c71 starts at pull request and treats dependency review as an explicit boundary rather than an implicit assumption. The first control requires GitHub Actions to emit an observable result before vulnerability can trigger the intended effect around license. To test dependency review, fixture dependency-review-policy-gate-c71 contains both an allowed state and a rejected state; rejection must occur before any change attributed to GitHub Actions. Operations then observes the transition between GitHub Actions and vulnerability, while security checks that license receives neither implicit authority nor unnecessary data. If the vulnerability verification fails, rollback restores the configuration around license, replays dependency-review-policy-gate-c71, and compares the new state with the control evidence from pull request.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c72 starts at dependency review and treats GitHub Actions as an explicit boundary rather than an implicit assumption. The first control requires vulnerability to emit an observable result before license can trigger the intended effect around pull request. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to GitHub Actions, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by vulnerability and pull request: anything not demonstrated by scenario dependency-review-policy-gate-c72 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns dependency review into a reviewable decision point with a named input and a retained output.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c73 starts at GitHub Actions and treats vulnerability as an explicit boundary rather than an implicit assumption. The first control requires license to emit an observable result before pull request can trigger the intended effect around dependency review. To test vulnerability, fixture dependency-review-policy-gate-c73 contains both an allowed state and a rejected state; rejection must occur before any change attributed to license. Operations then observes the transition between license and pull request, while security checks that dependency review receives neither implicit authority nor unnecessary data. If the pull request verification fails, rollback restores the configuration around dependency review, replays dependency-review-policy-gate-c73, and compares the new state with the control evidence from GitHub Actions.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c74 starts at vulnerability and treats license as an explicit boundary rather than an implicit assumption. The first control requires pull request to emit an observable result before dependency review can trigger the intended effect around GitHub Actions. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to license, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by pull request and GitHub Actions: anything not demonstrated by scenario dependency-review-policy-gate-c74 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns vulnerability into a reviewable decision point with a named input and a retained output.
Evidence point: GitHub documents that gitHub supply-chain controls combine dependency visibility, vulnerability alerts, automated updates and review workflows. This source anchors execute the procedure and observe the result but does not replace local verification. [S7]Controls that remain after launch
The starting point is not a feature; it is an observable decision boundary.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c81 starts at dependency review and treats GitHub Actions as an explicit boundary rather than an implicit assumption. The first control requires vulnerability to emit an observable result before license can trigger the intended effect around pull request. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns dependency review into a reviewable decision point with a named input and a retained output. To test GitHub Actions, fixture dependency-review-policy-gate-c81 contains both an allowed state and a rejected state; rejection must occur before any change attributed to vulnerability. Operations then observes the transition between vulnerability and license, while security checks that pull request receives neither implicit authority nor unnecessary data.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c82 starts at GitHub Actions and treats vulnerability as an explicit boundary rather than an implicit assumption. The first control requires license to emit an observable result before pull request can trigger the intended effect around dependency review. If the pull request verification fails, rollback restores the configuration around dependency review, replays dependency-review-policy-gate-c82, and compares the new state with the control evidence from GitHub Actions. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to vulnerability, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by license and dependency review: anything not demonstrated by scenario dependency-review-policy-gate-c82 is labeled as a limitation or inference, never promoted to fact.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c83 starts at vulnerability and treats license as an explicit boundary rather than an implicit assumption. The first control requires pull request to emit an observable result before dependency review can trigger the intended effect around GitHub Actions. That sequence serves this concrete job: Turn dependency diffs into an enforceable pull-request check with explicit vulnerability thresholds and exceptions. It turns vulnerability into a reviewable decision point with a named input and a retained output. To test license, fixture dependency-review-policy-gate-c83 contains both an allowed state and a rejected state; rejection must occur before any change attributed to pull request. Operations then observes the transition between pull request and dependency review, while security checks that GitHub Actions receives neither implicit authority nor unnecessary data.
In “Dependency review as policy: make vulnerable package changes fail visibly”, scenario dependency-review-policy-gate-c84 starts at license and treats pull request as an explicit boundary rather than an implicit assumption. The first control requires dependency review to emit an observable result before GitHub Actions can trigger the intended effect around vulnerability. If the GitHub Actions verification fails, rollback restores the configuration around vulnerability, replays dependency-review-policy-gate-c84, and compares the new state with the control evidence from license. This detail makes “Dependency review as policy: make vulnerable package changes fail visibly” reviewable because each operational statement points to pull request, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by dependency review and vulnerability: anything not demonstrated by scenario dependency-review-policy-gate-c84 is labeled as a limitation or inference, never promoted to fact.
Evidence point: GitHub documents that the dependency review action can fail pull requests based on vulnerability severity, dependency scope or license rules. This source anchors controls that remain after launch but does not replace local verification. [S8]Operational checklist
- The control around dependency review has an input, a rule, a rejection behavior, and evidence.
- The control around GitHub Actions has an input, a rule, a rejection behavior, and evidence.
- The control around vulnerability has an input, a rule, a rejection behavior, and evidence.
- The control around license has an input, a rule, a rejection behavior, and evidence.
- The control around pull request has an input, a rule, a rejection behavior, and evidence.
Sources and control points
- [S1] OWASP Top 10 for LLM Applications 2025 — The 2025 OWASP LLM list provides the prior baseline for risks observed as LLMs became embedded in more production applications. source
- [S2] Policies - Kubernetes — Kubernetes policy objects include NetworkPolicies for traffic controls and admission mechanisms for validating or mutating API requests. source
- [S3] Configuring OpenID Connect in cloud providers — GitHub Actions OIDC lets workflows obtain cloud access without storing long-lived cloud credentials, provided trust conditions constrain token issuance. source
- [S4] OpenID Connect reference - GitHub Docs — GitHub documents OIDC token claims such as issuer, audience and subject that cloud trust policies can evaluate. source
- [S5] Secure use reference - GitHub Actions — GitHub recommends pinning third-party actions to full-length commit SHAs to obtain an immutable reference. source
- [S6] Reviewing dependency changes in a pull request — Dependency review exposes added, removed and updated dependencies together with vulnerability context before changes are merged. source
- [S7] Supply chain security - GitHub Docs — GitHub supply-chain controls combine dependency visibility, vulnerability alerts, automated updates and review workflows. source
- [S8] Configuring the dependency review action — The dependency review action can fail pull requests based on vulnerability severity, dependency scope or license rules. source
- [S9] Artificial Intelligence Risk Management Framework: Generative AI Profile — NIST AI 600-1 is a generative-AI profile for integrating trustworthiness and risk actions across the AI lifecycle. source
- [S10] AI Risk Management Framework — NIST positions the AI RMF as a voluntary framework for managing AI risks and is revising it while adding profiles for specific settings. source
Comments
No published comment yet.
Sign in to comment