Question

A platform engineer adds the Dependency Review Action to a repository's pull request workflow, but every run fails with an error indicating the action cannot access the dependency comparison data for the pull request. The repository has GitHub Advanced Security enabled and the dependency graph is active. What is the MOST likely configuration issue causing this failure?

Accepted Answer

The workflow's GITHUB_TOKEN lacks the contents: read permission needed for the action to compare the base and head dependency data

Answer

Dependabot security updates have not been enabled, which the action depends on to retrieve comparison data

Answer

The action requires a personal access token stored as a secret because GITHUB_TOKEN cannot read the dependency graph

Answer

The repository is missing an SBOM export, which the action parses to generate the pull request diff