feat: Add GitHub Dependency Review Action for Pull Requests

[AnzalKhan16]

Problem statement

Problem Statement

The repository currently performs build, test, and security scanning workflows, but there is no automated validation of dependency changes introduced through pull requests.

As dependencies evolve, pull requests may unintentionally introduce vulnerable or unexpected packages. Without automated dependency review, maintainers must manually inspect dependency updates, which is time-consuming and error-prone.

Adding GitHub's Dependency Review Action would provide automated analysis of dependency changes and improve supply chain security during code review.

Proposed solution

Proposed Solution

Add a dedicated GitHub Actions workflow that runs GitHub's official Dependency Review Action on every pull request.

The workflow should:

• Trigger on pull requests targeting the main branch.
• Analyze dependency changes introduced by the pull request.
• Report newly added, removed, or updated dependencies.
• Fail the workflow if vulnerable dependencies are introduced.
• Integrate with the repository's existing GitHub Actions pipeline.

Alternatives considered

Alternatives Considered

• Manual dependency inspection during code reviews.
• Periodic security audits.
• Third-party dependency analysis tools.

GitHub Dependency Review provides native integration, minimal maintenance overhead, and continuous validation during pull request reviews.

Scope

Other

Affects Kubernetes deployment?

No — works the same on bare metal

Are you willing to contribute?

• I can implement this if guidance is provided
• I can test this once it's built
• I'm just suggesting the idea