require-dependency-review-action

Rule catalog ID: R091

Targeted pattern scope

Workflow files whose path indicates a dependency review workflow, such as .github/workflows/dependency-review.yml.

What this rule reports

This rule reports dependency review workflow files that do not invoke actions/dependency-review-action.

Why this rule exists

If a workflow is intended to perform dependency review, it should actually run the dependency review action. Otherwise the workflow name and file path advertise security coverage that the repository is not really getting.

❌ Incorrect

name: "Dependency Review"
on: [pull_request]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

✅ Correct

name: "Dependency Review"
on: [pull_request]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/dependency-review-action@v4

Additional examples

This rule is file-path-driven, which keeps it precise without forcing every repository to adopt a global workflow-existence contract.

ESLint flat config example

import githubActions from "eslint-plugin-github-actions-2";

export default [githubActions.configs.security];

When not to use it

Disable this rule if the repository intentionally uses a differently named workflow file or a reusable wrapper workflow for dependency review.

Targeted pattern scope​

What this rule reports​

Why this rule exists​

❌ Incorrect​

✅ Correct​

Additional examples​

ESLint flat config example​

When not to use it​

Further reading​