ci(security): use central dependency review

.github/workflows/dependency-review.yml

@@ -2,71 +2,20 @@ name: Dependency Review
 
 on:
   pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
   workflow_dispatch:
 
 permissions:
   contents: read
   pull-requests: read
 
 concurrency:
-  group: dependency-review-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Check dependency review support
-        id: dependency_review_support
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          REPOSITORY: ${{ github.repository }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [ "${{ github.event_name }}" != "pull_request" ]; then
-            echo "supported=false" >>"$GITHUB_OUTPUT"
-            echo "Dependency review only runs as a hard gate for pull_request events."
-            exit 0
-          fi
-
-          api_url="${GITHUB_API_URL:-https://api.github.com}"
-          response_file="$(mktemp)"
-          status="$(
-            curl -fsS -o "$response_file" -w '%{http_code}' \
-              -H "Accept: application/vnd.github+json" \
-              -H "Authorization: Bearer ${GH_TOKEN}" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "${api_url}/repos/${REPOSITORY}/dependency-graph/compare/${BASE_SHA}...${HEAD_SHA}" \
-              || true
-          )"
-
-          if [ "$status" = "200" ]; then
-            echo "supported=true" >>"$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [ "$status" = "403" ] || [ "$status" = "404" ]; then
-            echo "::warning::Dependency review is unavailable for ${REPOSITORY}; skipping dependency-review hard gate."
-            echo "supported=false" >>"$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          echo "::error::Dependency review support check failed with HTTP ${status}."
-          cat "$response_file"
-          exit 1
-
-      - name: Dependency review
-        if: steps.dependency_review_support.outputs.supported == 'true'
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          fail-on-severity: moderate
-          comment-summary-in-pr: on-failure
+    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
+    uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@f43dcb884be5a0efc61611b5c8cb83c4c7735995
+    with:
+      fail_on_severity: moderate

tests/config/test_strix_static_repo_adaptations.py

@@ -60,7 +60,11 @@ def test_companion_workflows_cover_named_requirements_manifests_and_full_history
     dependency_review_source = DEPENDENCY_REVIEW_WORKFLOW.read_text(encoding="utf-8")
     osv_source = OSV_WORKFLOW.read_text(encoding="utf-8")
 
-    assert "actions/dependency-review-action@" in dependency_review_source
+    assert (
+        "uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@"
+        "f43dcb884be5a0efc61611b5c8cb83c4c7735995"
+        in dependency_review_source
+    )
     assert 'requirements(-[A-Za-z0-9._-]+)?\\.txt' in osv_source
     assert "google/osv-scanner-action" in osv_source
     assert "-r" in osv_source