Add Dependency Review GitHub Action

[haritamar]

Summary

Adds actions/dependency-review-action@v4 workflow to scan PRs for vulnerable or improperly-licensed dependency changes.

• Triggers on pull_request and workflow_dispatch (manual runs require base-ref input, e.g. a tag or commit SHA, to define the comparison range; head-ref defaults to HEAD)
• fail-on-severity: high — only blocks PRs on HIGH/CRITICAL vulnerabilities (moderate/low reported but don't fail)
• persist-credentials: false on checkout for security
• License enforcement via allow-licenses allowlist covering permissive (MIT, Apache-2.0, BSD, ISC, etc.) and weak copyleft (LGPL, MPL-2.0) — blocks strong copyleft (GPL, AGPL), proprietary, SSPL, BUSL, Elastic, and any other unlisted license

Link to Devin session: https://app.devin.ai/sessions/0f830b140bd8488797ab340ef05dc88f
Requested by: @haritamar

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 @haritamar
Thank you for raising your pull request.
Please make sure to add tests and document all user-facing changes.
You can do this by editing the docs files in this pull request.

[coderabbitai]

Warning

Review limit reached

@devin-ai-integration[bot], we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 49 minutes and 1 second. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c2663ff1-5262-4f70-bb6a-648bae5757a7

📥 Commits

Reviewing files that changed from the base of the PR and between 39e10b2 and 5e9efeb.

📒 Files selected for processing (2)

• .github/dependency-review-config.yml
• .github/workflows/dependency-review.yml

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow that runs dependency review on pull requests and manual dispatches with restricted permissions.

Changes

Dependency review workflow

Layer / File(s)	Summary
Workflow configuration .github/workflows/dependency-review.yml	Defines the workflow triggers, top-level permissions, checkout step, and actions/dependency-review-action@v4 with an allow-licenses list.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 I hopped by the workflow gate,
With checks that guard the dependency state.
A checkout here,
A scan crystal-clear,
And licenses lined up just right to date.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: adding a dependency review GitHub Actions workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch devin/1782396276-add-dependency-review

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/dependency-review.yml:
- Around line 12-13: The dependency-review workflow’s actions/checkout step is
leaving the GitHub token persisted in local git config by default. Update the
Checkout repository step to disable persisted credentials by setting
persist-credentials to false in the checkout action, keeping the change scoped
to the existing checkout job.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ddfafe8a-c9f1-460e-bc31-e32de77a52f8

📥 Commits

Reviewing files that changed from the base of the PR and between ab917b2 and cfdcf6e.

📒 Files selected for processing (1)

• .github/workflows/dependency-review.yml