Question

A platform team wants to add the Dependency Review action to pull request workflows for a private repository so that vulnerable or non-compliant dependency changes are flagged before merge. When they run the workflow, the action fails with an error indicating it cannot access dependency data. Which prerequisite must be satisfied for the Dependency Review action to function in this repository?

Accepted Answer

The dependency graph must be enabled for the repository (the dependency graph itself needs no license); on private repositories the Dependency Review feature it feeds is what requires GitHub Code Security (GHAS)

Answer

Dependabot version updates must be configured with a dependabot.yml file in the repository

Answer

A security campaign must be created at the organization level and assigned to the repository

Answer

Secret scanning push protection must be enabled so the action can validate commit contents