Question

Your team maintains a public repository with GitHub Advanced Security enabled. Security wants to prevent contributors from merging pull requests that introduce new dependencies with known high or critical vulnerabilities, and they want the check to run automatically on every PR before it can be merged. Which combination should you implement?

Accepted Answer

Enable the Dependency Review Action in a workflow triggered on pull_request, configure it with a fail-on-severity of high, and make the workflow a required status check in branch protection.

Answer

Enable Dependabot version updates in dependabot.yml so it opens PRs that upgrade vulnerable packages before the contributor's PR is merged.

Answer

Enable secret scanning push protection on the default branch to block commits containing vulnerable dependency references.

Answer

Configure a CodeQL analysis workflow with the security-extended query suite and set it as a required check for pull requests.