name: Dependency Review
on:
  pull_request:

permissions:
  contents: read

jobs:
  review:
    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@3f746774229d41770727e2e4fd63ed5f5555a8b3 # v1.0.3
    with:
      # GHSA-3jxr-9vmj-r5cp (brace-expansion ReDoS): bundled transitive inside
      # aws-cdk-lib (inBundle, not overridable via lockfile); adjudicated in
      # .security-review/suppressions.json. Remove when aws-cdk-lib bundles >=5.0.8.
      allow-ghsas: GHSA-3jxr-9vmj-r5cp