Update deps profile with new trusty config

This commit updates the trusty config in the deps profile to use the new configuration fields exposed by the trusty evaluator. Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>
mindersec · May 23, 2024 · 51ec8c1 · 51ec8c1
1 parent d5d70c9
commit 51ec8c1
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/profiles/github/dependencies.yaml b/profiles/github/dependencies.yaml
@@ -32,12 +32,17 @@ pull_request:
             url: https://pypi.org/pypi
   - type: pr_trusty_check
     def:
-      action: summary
+      action: review
       ecosystem_config:
         - name: npm
           score: 5
+          allow_malicious: false
         - name: pypi
           score: 5
+          allow_malicious: false
+        - name: go
+          score: 5
+          allow_malicious: false
 repository:
   - type: dependabot_configured
     name: dependabot_configured_go