[ci] Dependency Review workflow fails — Dependency graph not enabled on repository

[judeper]

[ci] Dependency Review workflow fails because Dependency Graph is not enabled on this repository

Symptom

Every PR targeting main runs Dependency Review, which fails consistently with:

##[error]Dependency review is not supported on this repository. Please ensure that
Dependency graph is enabled, see https://github.com/judeper/FSI-CopilotGov-Solutions/settings/security_analysis

Dependency Review only runs on pull_request events, so historical failures on PRs #192–#217 in the 2026-05-04 accuracy review cycle are visible in the Actions tab.

Cause

actions/dependency-review-action@v4 requires the Dependency graph GitHub Advanced Security feature to be enabled at the repo level. For this private (or org-restricted) repository, the feature is currently OFF.

Fix — pick one

Option A — enable Dependency graph (recommended)

1. Repo admin opens Settings → Security → Code security and analysis.
2. Toggle Dependency graph to Enabled.
3. Optionally enable Dependabot alerts and Dependabot security updates.
4. Re-run the latest failed Dependency Review workflow to confirm green.

This is free for public repositories. For private repos in this organization, confirm GHAS licensing covers it; if not, fall back to Option B.

Option B — remove the workflow

If Dependency graph cannot be enabled (licensing or org policy), delete .github/workflows/dependency-review.yml. The repository ships only Python and PowerShell tooling with no third-party runtime npm/Maven/etc. dependency surface, so actions/dependency-review-action provides limited value.

Option C — guard the job behind a feature flag

jobs:
  dependency-review:
    if: vars.DEPENDENCY_GRAPH_ENABLED == 'true'
    ...

…then leave the variable unset until the feature is enabled.

Acceptance criteria

• No PR is blocked by Dependency Review failing for "not supported" reasons.
• Either: workflow runs and produces a real result on at least one PR, OR the workflow is removed/gated.

References

• Failing run: https://github.com/judeper/FSI-CopilotGov-Solutions/actions/runs/25349324907
• GitHub Docs — Configuring the dependency graph: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-the-dependency-graph
• Introduced in: commit ccf0cf5 ("critique-response — tier metadata, coverage honesty, security & CI hardening")

[judeper]

Already fixed on \main\ by PR #245 (removed the unnecessary actions/checkout@v4 step in dependency-review.yml that was failing deterministically) and PR #246 (added .github/dependabot.yml + enabled repository vulnerability alerts via automated-security-fixes API). Dependency Review now exercises end-to-end Dependency Graph scanning.