Add Dependency Review Action to block vulnerable dependency changes #1987

Summary

GStack has dependency-bearing manifests (package.json, bun.lock) but no pull-request dependency review gate. A PR can currently add or bump an npm/Bun dependency without a CI check that blocks newly introduced known vulnerabilities.

GitHub's current dependency review action is designed for this exact PR-time guard: it compares dependency changes in the pull request and can fail the workflow when vulnerable dependencies are introduced.

Repo-local evidence

• origin/main has workflow files under .github/workflows/: actionlint.yml, ci-image.yml, evals.yml, evals-periodic.yml, make-pdf-gate.yml, pr-title-sync.yml, skill-docs.yml, version-gate.yml, windows-free-tests.yml, windows-setup-e2e.yml.
• git grep -n -E 'dependency-review|osv-scanner|scorecard|ossf/scorecard|semgrep|codeql-action|github/codeql|attest-build-provenance|attestation|Dependabot' origin/main -- .github package.json bun.lock returned no matches.
• origin/main:package.json includes runtime dependencies (@huggingface/transformers, @ngrok/ngrok, diff, marked, playwright, puppeteer-core, socks) and dev dependencies (@anthropic-ai/claude-agent-sdk, @anthropic-ai/sdk, xterm, xterm-addon-fit).
• bun.lock is tracked on origin/main, so dependency changes have a concrete lockfile surface for PR review.
• The repo already has a live dependency-security example: diff@7.0.0 has DoS advisory in parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx) #1588 tracks diff@7.0.0 / GHSA-73rr-hh4g-fpgx, with v1.60.2.0 fix(deps): bump diff to ^9.0.0 to clear GHSA-73rr-hh4g-fpgx (#1588) #1599 opened as the bump. That kind of issue should be caught at dependency-change time, not only after a separate security review.

Expected impact

• Blocks PRs that introduce known vulnerable dependencies before they merge.
• Gives contributors immediate feedback in the PR instead of relying on later manual review or ad hoc issue filing.
• Complements CI hardening: provider API keys exposed on pull_request (evals.yml) + third-party actions pinned to mutable tags #1948: that issue covers secret exposure and mutable action tags; this one covers project dependency vulnerability gating.

Suggested fix

Add a focused workflow, for example .github/workflows/dependency-review.yml:

• Trigger on pull_request when package.json, bun.lock, or the workflow itself changes.
• Use least-privilege permissions: contents: read.
• Run actions/dependency-review-action with a pinned full commit SHA, not a mutable tag, to stay aligned with CI hardening: provider API keys exposed on pull_request (evals.yml) + third-party actions pinned to mutable tags #1948.
• Start with fail-on-severity: moderate and fail-on-scopes: runtime, development, then tune if this is too noisy.

GitHub docs: https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configuring-the-dependency-review-action

Duplicate check performed

• Inspected 200 open issues with gh issue list --repo garrytan/gstack --state open --limit 200 --json number,title,body,url,updatedAt,labels.
• Inspected 200 open PRs with gh pr list --repo garrytan/gstack --state open --limit 200 --json number,title,body,url,updatedAt,headRefName,isDraft,labels.
• Searched open issues/PRs for: dependency review, OSV, OpenSSF, Scorecard, Semgrep, workflow permissions, least privilege, GITHUB_TOKEN permissions, and contents: read.
• No open issue or PR covers adding a dependency review gate. Adjacent items found:
  • CI hardening: provider API keys exposed on pull_request (evals.yml) + third-party actions pinned to mutable tags #1948 covers provider API key exposure and mutable action tags.
  • diff@7.0.0 has DoS advisory in parsePatch/applyPatch (GHSA-73rr-hh4g-fpgx) #1588 / v1.60.2.0 fix(deps): bump diff to ^9.0.0 to clear GHSA-73rr-hh4g-fpgx (#1588) #1599 cover one specific vulnerable dependency bump.
  • fix(ci): add workflow-level permissions for PR comments #663 covers PR-comment workflow permissions for evals.yml, not dependency vulnerability gating.

Commands/files inspected

• gh issue list --repo garrytan/gstack --state open --limit 200 --json number,title,body,url,updatedAt,labels
• gh pr list --repo garrytan/gstack --state open --limit 200 --json number,title,body,url,updatedAt,headRefName,isDraft,labels
• gh api --method GET search/issues -f q='<targeted query>'
• git fetch origin main
• git ls-tree -r --name-only origin/main .github
• git grep -n -E 'dependency-review|osv-scanner|scorecard|ossf/scorecard|semgrep|codeql-action|github/codeql|attest-build-provenance|attestation|Dependabot' origin/main -- .github package.json bun.lock
• git show origin/main:package.json
• git ls-tree -r --name-only origin/main | egrep '(^|/)(bun.lockb|bun.lock|package-lock.json|pnpm-lock.yaml|yarn.lock)$'