Question

A financial services company mandates that no dependency using a GPL-3.0 license may be merged into their default branch. A platform engineer is configuring the Dependency Review Action in a GitHub Actions workflow to enforce this. Which configuration approach will cause the pull request check to FAIL when a newly introduced dependency uses GPL-3.0?

Accepted Answer

Set the `deny-licenses` parameter in the Dependency Review Action configuration to include `GPL-3.0`, causing the action to fail the check when a matching license is detected in added dependencies

Answer

Enable Dependabot version updates with a license filter in `dependabot.yml` so that GPL-3.0 packages are never proposed in update PRs

Answer

Add GPL-3.0 to the repository's Dependabot alert auto-dismiss rules so the alert is raised and blocks the merge

Answer

Configure a branch protection rule that requires the dependency graph to reject GPL-3.0 licenses before allowing a merge