name: Dependency Review
on:
  pull_request:

permissions:
  contents: read

jobs:
  review:
    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@e5691d8a7f96ac4d5a841a82975ff0a4354d53ac # v1.0.7
    with:
      # brace-expansion OOM DoS: no in-range fix (patch only in 5.0.8; @11ty/recursive-copy
      # pins minimatch <10.0.3). Build-time-only exposure, adjudicated in
      # .security-review/suppressions.json — remove when recursive-copy bumps minimatch.
      allow-ghsas: GHSA-mh99-v99m-4gvg