CI: Run dependency security audits on pull requests and pushes to master branch

[EveGoodEvening]

Background

Dependabot periodically checks for updates and opens pull requests, but this asynchronous process does not validate the currently locked dependencies on every change.

Scope

Cover npm/pnpm and Python dependencies. Evaluate whether GitHub Actions dependencies can be included.

Acceptance criteria:

• The audit runs on pull requests and pushes to master.
• It checks the resolved versions in lockfiles, not only direct dependency declarations.
• Vulnerabilities at or above an agreed severity threshold fail the CI job with actionable details, including the affected dependency, advisory identifier, and fixed version when available.
• The severity threshold, accepted exceptions, and exception expiry policy are explicitly configured.
• Dependabot remains responsible for proposing updates; the audit workflow provides change-time detection and enforcement without duplicating that responsibility.

Deliverables

A dependency audit workflow, either standalone or integrated into the existing CI workflow, plus the required configuration and maintenance documentation.

Test evidence

Demonstrate that the audit fails for a controlled vulnerable dependency or equivalent fixture, then passes after restoring a safe version.

Implementation options

Prefer GitHub Dependency Review where applicable, supplemented by lockfile-aware tools such as pnpm audit, pip-audit, or OSV. Avoid redundant scans and unreliable external calls.

Example

EveGoodEvening#1