Identify the components
Start with the dependencies included in the release being reviewed.
Developer / Security testing
Developer helps engineers inspect the components behind a release, connecting dependency information to the artifact and the review questions that need an answer before it ships.
In the workspace
Document parser · Newly introduced dependency
Package origin and transitive dependencies
Version and usage · Engineer review requested
Keep component questions attached to the release candidate.
The engineer can assess the new component in its release context and decide what needs further investigation.
Start with the dependencies included in the release being reviewed.
Examine newly introduced components and the dependency context available to the team.
Carry unresolved questions or required changes into the release review.
Explore supply chain review around your company’s workflows.