Add Dependency Review Action workflow

[Jatin-8898]

This workflow scans dependency manifest files in pull requests for known vulnerabilities and blocks merging if vulnerable packages are introduced.

Please annotate your PR title to describe what the PR does, then give a brief bulleted description of your PR below. PR titles should begin with [BUGFIX], [FEATURE], [DOCS], [MAINTENANCE], or [CONTRIB]. If a new feature introduces breaking changes for the or configuration files, please also add [BREAKING].

Description

[Describe the issue or feature that this pull request is addressing. Provide context and any relevant links to issues or documentation.]

Changes Made

[Describe the changes made in this pull request, including any new code or dependencies added, removed, or updated.]

Definition of Done

Before submitting this pull request, please ensure that the following criteria have been met:

• All automated tests have passed successfully.
• All manual tests have passed successfully.
• Code has been reviewed by at least one other team member.
• Code has been properly documented and commented as needed.
• All new and existing code adheres to our project's coding standards.
• All dependencies have been added or removed from the project's README or other documentation as needed.
• Any relevant documentation or help files have been updated to reflect the changes made in this pull request.
• Any necessary database migrations have been run.
• Any relevant UI changes have been reviewed and approved by the UI/UX team.

Additional Notes

[Add any additional notes or context for the reviewer or future maintainers of this code.]

Thank you for submitting!

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/dependency-review.yml

Package	Version	License	Issue Type
actions/checkout	4.*.*	Null	Unknown License
actions/dependency-review-action	4.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	4.*.*	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 22 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/dependency-review-action	4.*.*	🟢 7.7	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 28 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 9 security policy file detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 9 SAST tool detected but not run on all commits

Scanned Files

• .github/workflows/dependency-review.yml

[Copilot]

🟡 Changes recommended

The workflow’s PR-comment configuration can cause failures on fork-based pull requests due to read-only token permissions, impacting CI reliability.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a GitHub Actions workflow to run the GitHub Dependency Review Action on pull requests, helping prevent introduction of known-vulnerable dependencies as part of the repo’s CI security gates.

Changes:

• Introduces .github/workflows/dependency-review.yml to run actions/dependency-review-action on PRs targeting main.
• Enables PR comment summaries for dependency review results.

File summaries

File	Description
.github/workflows/dependency-review.yml	Adds a Dependency Review workflow to scan dependency changes on PRs and report results.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kaushik-sb]

Changes look good