Dependency Review workflow (webpack/webpack)
The Dependency Review workflow from webpack/webpack, explained and optimized by Latchkey.
C
CI health: C - fair
Point runs-on at Latchkey and get run de-duplication, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Dependency Review workflow from the webpack/webpack repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
workflow (.yml)
name: Dependency Review
on:
pull_request:
permissions:
contents: read
jobs:
dependency-review:
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Dependency Review
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
with:
allow-dependencies-licenses: |
pkg:npm/@cspell/dict-django,
pkg:npm/@cspell/dict-en-common-misspellings,
pkg:npm/flatted,
pkg:npm/parse-imports,
pkg:npm/prettier,
pkg:npm/type-fest,
pkg:npm/abbrev,
pkg:npm/@pkgjs/parseargs,
pkg:npm/@apidevtools/json-schema-ref-parser,
pkg:npm/cookie-signature,
pkg:npm/ansis,
pkg:npm/strtok3,
pkg:npm/@sinclair/typebox,
pkg:npm/fs-monkey
allow-licenses: |
0BSD,
AFL-1.1,
AFL-1.2,
AFL-2.0,
AFL-2.1,
AFL-3.0,
AGPL-3.0-only,
AGPL-3.0-or-later,
Apache-1.1,
Apache-2.0,
APSL-2.0,
Artistic-2.0,
BlueOak-1.0.0,
BSD-2-Clause,
BSD-3-Clause-Clear,
BSD-3-Clause,
BSL-1.0,
CAL-1.0,
CC-BY-3.0,
CC-BY-4.0,
CC-BY-SA-4.0,
CDDL-1.0,
CC0-1.0,
EPL-2.0,
GPL-2.0-only,
GPL-2.0-or-later,
GPL-2.0,
GPL-3.0-or-later,
ISC,
LGPL-2.0-only,
LGPL-2.1-only,
LGPL-2.1-or-later,
LGPL-2.1,
LGPL-3.0-only,
LGPL-3.0,
MIT,
MPL-2.0,
OFL-1.1,
PSF-2.0,
Python-2.0,
Python-2.0.1,
Unicode-DFS-2016,
Unlicense
The same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
name: Dependency Review on: pull_request: permissions: contents: read concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true jobs: dependency-review: timeout-minutes: 30 runs-on: latchkey-small steps: - name: Checkout Repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Dependency Review uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 with: allow-dependencies-licenses: | pkg:npm/@cspell/dict-django, pkg:npm/@cspell/dict-en-common-misspellings, pkg:npm/flatted, pkg:npm/parse-imports, pkg:npm/prettier, pkg:npm/type-fest, pkg:npm/abbrev, pkg:npm/@pkgjs/parseargs, pkg:npm/@apidevtools/json-schema-ref-parser, pkg:npm/cookie-signature, pkg:npm/ansis, pkg:npm/strtok3, pkg:npm/@sinclair/typebox, pkg:npm/fs-monkey allow-licenses: | 0BSD, AFL-1.1, AFL-1.2, AFL-2.0, AFL-2.1, AFL-3.0, AGPL-3.0-only, AGPL-3.0-or-later, Apache-1.1, Apache-2.0, APSL-2.0, Artistic-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CDDL-1.0, CC0-1.0, EPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-or-later, ISC, LGPL-2.0-only, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, MIT, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Cancel superseded runs when a branch or PR gets a newer push.
- Add a job timeout so a hung step cannot burn hours of runner time.
This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.