ci: add dependency review workflow

[wizzomafizzo]

Summary

• Add dependency review on PRs targeting main
• Blocks PRs that introduce dependencies with known vulnerabilities or disallowed licenses

Summary by CodeRabbit

• Chores
  • Added automated dependency review workflow for pull requests targeting the main branch.

[coderabbitai]

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow is introduced that automatically performs dependency reviews on pull requests targeting the main branch. The workflow uses pinned action versions and sets repository permissions to read-only for contents access.

Changes

Cohort / File(s)	Summary
Dependency Review Workflow .github/workflows/dependency-review.yml	New workflow file that executes dependency review checks on PRs to main branch, with pinned action versions and read-only repository permissions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• ci: harden workflows with pinned SHAs and explicit permissions #69: Both PRs harden GitHub Actions workflows by pinning action SHAs and applying restrictive permissions configurations.

Poem

🐰 A workflow so keen,
Dependencies reviewed, squeaky-clean!
Pinned actions stand guard,
With permissions that're hard—
Security's tight on the main branch scene! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: add dependency review workflow' is a concise, specific summary that directly matches the main change: adding a GitHub Actions workflow for dependency review.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dep-review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/dependency-review.yml:
- Around line 18-19: The Dependency Review workflow step ("Dependency Review"
that uses
actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48) lacks
an explicit license policy; update that step to include a with: configuration
that either sets deny-licenses (a comma-separated list of license identifiers
you want to block) or points to a config-file (e.g.,
.github/dependency-review.yml) that defines the license denylist and rules, so
the dependency-review action will enforce disallowed licenses on PRs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 743b52a0-f159-423f-856b-18fecb4b68ce

📥 Commits

Reviewing files that changed from the base of the PR and between baa7641 and 9566819.

📒 Files selected for processing (1)

• .github/workflows/dependency-review.yml