Rolling Out Dependency Review Across Your Entire Organization

  1. Create a new repository/utilize an existing repository to serve as the centralized home for the Dependency Review GitHub Action reusable workflow

  2. Optional - Control member access to this repository

  3. Adjust access settings so other repositories can access the workflow

  4. Bring in Dependency Review from GitHub Marketplace

    • Repo Settings --> Code Scanning --> New Tool --> Search “Dependency Review” --> Configure

  5. Configure optional parameters for configuration (fail-on severity, allow or deny-license list) and commit to your repo

  6. Create a ruleset at the Organization to require this workflow across repos

    • Configure your Target Repositories to All Repositories
    • Choose “Require workflows to pass before merging” rule
    • Select the Dependency Review workflow

  7. Optional - Continue to use this new repo to centrally maintain other GitHub Action workflows

These steps will enable and enforce Dependency Review across your Organization. You do not need to do any per-repo configuration for this.