ci: Add depcheck test

[Gudahtt]

Development & PR Process

1. Follow MetaMask Mobile Coding Standards
2. Add release-xx label to identify the PR slated for a upcoming release (will be used in release discussion)
3. Add needs-dev-review label when work is completed
4. Add the appropiate QA label when dev review is completed
   • needs-qa: PR requires manual QA.
   • No QA/E2E only: PR does not require any manual QA effort. Prior to merging, ensure that you have successful end-to-end test runs in Bitrise.
   • Spot check on release build: PR does not require feature QA but needs non-automated verification. In the description section, provide test scenarios. Add screenshots, and or recordings of what was tested.
5. Add QA Passed label when QA has signed off (Only required if the PR was labeled with needs-qa)
6. Add your team's label, i.e. label starting with team- (or external-contributor label if your not a MetaMask employee)

Description

A test has been added to CI to ensure we don't accidentally leave packages in our manifest that aren't used, or forget to list packages in our mainfest.

We have a large number of seemingly unused or missing dependencies at the moment. Rather than fixing them all at once, they have been temporarily ignored. This lets us stop the problem from getting worse without delay. Each ignored dependency will be addressed in a later PR.

Issue

No related issue

Checklist

• There is a related GitHub issue
• Tests are included if applicable
• Any added code is fully documented

[socket-security]

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
depcheck	1.4.5	filesystem	+25	8.25 MB	rumpl

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: global-prefix@1.0.2, resolve-dir@1.0.1, expand-tilde@2.0.2, homedir-polyfill@1.0.3, detect-file@1.0.0, deps-regex@0.1.4, source-map-js@1.0.2, parse-passwd@1.0.0, multimatch@5.0.0, require-package-name@2.0.1, global-modules@1.0.0, findup-sync@5.0.0, array-differ@3.0.0, callsite@1.0.0, arrify@2.0.1, depcheck@1.4.5

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

[Gudahtt]

@SocketSecurity ignore-all

The unmaintained packages have no clear alternatives. The "new authors" are for versions ~6 years old. The one package with filesystem access is supposed to have filesystem access (depcheck needs to read the depcheck config file).

[codecov-commenter]

Codecov Report

Patch and project coverage have no change.

Comparison is base (eafdda1) 32.83% compared to head (44f43a4) 32.83%.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7124   +/-   ##
=======================================
  Coverage   32.83%   32.83%           
=======================================
  Files        1006     1006           
  Lines       32727    32727           
  Branches     8396     8396           
=======================================
  Hits        10745    10745           
  Misses      21982    21982           

☔ View full report in Codecov by Sentry.

📢 Have feedback on the report? Share it here.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[Cal-L]

LGTM