security: make central dependency-review unavailability fail closed

[seonghobae]

Organization-wide security-gate defect

The central required workflow .github/workflows/security-scan.yml currently documents dependency review as a HARD diff-scoped gate, but deliberately converts GitHub dependency-review API 403/404 responses into a successful skip:

Dependency review is unavailable for ${REPOSITORY}; skipping dependency-review hard gate.

The job then exits 0, skips actions/dependency-review-action, and allows the bundled required Security Scan to conclude success.

This is not equivalent to a clean dependency review and creates a false-green supply-chain result.

Exact downstream evidence

ContextualWisdomLab/EgressWeave is public. On EgressWeave PR #66 exact head c038a9509d1a8eae8561cc9081e67e12bd373d42, Security Scan run 31108241013, dependency-review job 92638903658, the exact comparison

10d0c51daf2ad278d66f43be479df8cf6b08ba6d...c038a9509d1a8eae8561cc9081e67e12bd373d42

returned HTTP 403. The workflow emitted the skip warning, did not execute actions/dependency-review-action, and still concluded success. EgressWeave tracks the buyer-visible downstream blocker in ContextualWisdomLab/EgressWeave#76.

GitHub's current documentation states that dependency review and the dependency-review action are available for all public GitHub.com repositories when dependency graph is enabled. The dependency-review REST API may be used without authentication for public resources; with a fine-grained token, Contents: read is sufficient. Therefore a 403 on a public non-fork repository is not valid clean-review evidence and requires diagnosis rather than normalization to success.

Current integration opportunity

Open PR #799 already changes this same central workflow and exact-head dependency-review checkout contracts from protected main f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae. If #799's exact head remains suitable, prefer extending that PR test-first rather than opening a competing workflow PR. If #799 advances incompatibly, keep this as a separate bounded follow-up from then-current protected main.

Acceptance criteria

• Add an immutable RED contract proving the current 403/404 success-skip path is forbidden.
• Preserve explicit exact head repository + exact head SHA checkout and exact BASE_SHA...HEAD_SHA comparison binding.
• A 200 support probe may proceed to the immutable-pinned actions/dependency-review-action hard gate.
• A 403, 404, malformed/empty HTTP status, transport failure, timeout, truncated response, unexpected status, or other inability to establish dependency-review support must not be reported as dependency-review passed.
• For public repositories, fail closed on dependency-review unavailability and emit an actionable error telling operators to verify repository dependency-graph/security configuration and GitHub service behavior.
• Do not guess a root cause from 403; record repository visibility, exact base/head, and status without leaking credentials or response bodies that may contain sensitive detail.
• If support for private/internal repositories lacking GitHub Code Security is required, implement only an explicit organization-governed exception with documented compensating controls and an unmistakable not-applicable result. Do not infer N/A from 403/404 inside branch-controlled code.
• Preserve least privilege: contents: read, no repository/ref/package/release write, no OIDC, no model credential, no caller-controlled code under a privileged identity.
• Preserve immutable action pins and the independent OSV, Trivy, Scorecard, CodeQL/SAST/secret surfaces; do not make another scanner a semantic substitute for dependency review.
• Add/update beginner-readable doctoring with APA 7 primary GitHub references and one [Unreleased] Security entry; no release/version bump.
• Prove focused contracts and the complete central test/coverage/docstring/compile quality contract, then obtain exact-current-head Security Scan and all other required central checks/reviews plus qualifying independent non-author approval before merge.

Trust boundary

This is a required-workflow control-plane fix. Do not add a branch-local publisher, contents: write, push/rebase/merge authority, workflow self-modification, -X ours/theirs, temporary write-capable repair workflow, or execution of model-modified source under a write credential. Any repair branch must remain exact-head bound and stale-head refusing.

Primary references (APA 7th)

GitHub. (n.d.). Dependency review. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-review

GitHub. (n.d.). REST API endpoints for dependency review. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/enterprise-cloud@latest/rest/dependency-graph/dependency-review

GitHub. (n.d.). Dependency graph. GitHub Docs. Retrieved August 7, 2026, from https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-graph

Related

• Downstream evidence: security: fail closed when dependency review is unavailable EgressWeave#76
• Current overlapping central workflow PR: fix(security): bind repository scanners to exact PR head #799
• Prior dependency-snapshot/base-graph repair: merged PR fix(ci): snapshot dependencies on default-branch pushes so dependency-review has a base #736

[seonghobae]

Exact-head implementation update, not closure: existing PR #799 has progressed test-first to exact head dfa28786a6d57628b26ddbf1f466cbf9084e725d. Immutable RED 2d1603f1c307be83a12d8b2f847d6a91b1ce97b3 exposed the forbidden 403/404 supported=false skip. GREEN 7c0b6f9ffb7bc1c6364df3101879191648302210 removes that path, accepts only HTTP 200, discards the untrusted API body, and fails closed otherwise; subsequent docs/changelog/contract-correction commits end at the current SHA.

Current-head evidence is materially stronger than the original downstream failure: Security Scan run 31144419104 dependency-review job 92760819070 executed both the support probe and the pinned dependency-review action successfully, and the current SHA also has successful Python Security, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, SBOM, and dedicated exact-head quality runs. No current-head unresolved review thread is present.

Keep #810 open. PR #799 is Draft again because current-head CodeRabbit review is rate-limited/pending, the prior OpenCode review was anchored to predecessor head 323c07b794d11f82c04db91544bc3a3f5cf5ad5c and dismissed, and no qualifying independent non-author approval exists. After exact-current-head automated review and independent approval, integrate without bypass; then require a downstream EgressWeave exact-head canary before closing #810/#76. Do not treat the pre-repair EgressWeave Security Scan greens as evidence under the repaired contract.