chore: [SEC-7263] Add dependency-scan GitHub Actions workflow

[pkaeding]

BEGIN_COMMIT_OVERRIDE
chore: Add dependency-scan GitHub Actions workflow
END_COMMIT_OVERRIDE

Summary

Adds a GitHub Actions workflow to generate Software Bill of Materials (SBOM) for Node.js dependencies and evaluate them against security policies as part of SEC-7263.

Requirements

• I have added test coverage for new or changed functionality (N/A - workflow addition)
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions (will be validated via CI)

Related issues

Part of security initiative SEC-7263 to add dependency scanning workflows across LaunchDarkly npm ecosystem repositories.

Describe the solution you've provided

This PR adds a new GitHub Actions workflow (.github/workflows/dependency-scan.yml) that:

1. Generates Node.js SBOM using launchdarkly/gh-actions/actions/dependency-scan/generate-sbom@main
2. Evaluates SBOM against policies using launchdarkly/gh-actions/actions/dependency-scan/evaluate-policy@main
3. Triggers on pull requests and pushes to main branch
4. Uses public gh-actions (appropriate for public repositories)

The workflow consists of two sequential jobs:

• generate-nodejs-sbom: Creates the SBOM artifact
• evaluate-policy: Evaluates the SBOM against security policies (depends on first job)

Key Review Points

⚠️ Important: This workflow has not been tested locally and needs validation via CI to ensure:

• The artifact pattern bom-* correctly matches generated SBOM files
• The workflow runs successfully without configuration issues
• Policy evaluation completes without violations

Describe alternatives you've considered

• Using commit-specific versions instead of @main for actions (decided against to follow established org patterns)
• Different trigger configurations (current setup matches standard LaunchDarkly practices)

Additional context

• Link to Devin run: https://app.devin.ai/sessions/434bb14b7bac4d81b9979b88965be92b
• Requested by: @pkaeding
• Part of systematic rollout across LaunchDarkly npm repositories
• Uses public gh-actions repository (appropriate for public repos vs private common-actions)

---

Note

Low Risk
Low risk: adds a new GitHub Actions workflow only, though it may affect CI signal/required checks on PRs and main pushes.

Overview
Introduces a new GitHub Actions workflow, dependency-scan.yml, that runs on pull requests and pushes to main.

The workflow reuses LaunchDarkly’s centralized launchdarkly/gh-actions dependency scan workflow configured for nodejs, inheriting repository secrets.

^{Written by Cursor Bugbot for commit 24d3d4b. This will update automatically on new commits. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring