Merge pull request #68 from swan-bitcoin/rafal/psec-3499-add-analyze-dependencies-ci-workflow-to-xpub-tool-repo

feat: PSEC-3499 Add analyze-dependencies CI workflow

Author: rafalry

.github/workflows/dependency-review.yml

@@ -0,0 +1,98 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable
+# packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
+name: 'Dependency review'
+on:
+  pull_request:
+    branches: [ "master"]
+  merge_group:
+    branches: [ "master"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# If using a dependency submission action in this workflow this permission will need to be set to:
+#
+# permissions:
+#   contents: write
+#
+# https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
+
+jobs:
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: write  # Only needed for comment-summary-in-pr
+    runs-on: ${{ vars.ACTIVE_RUNNER_LABEL }}
+    steps:
+      - name: 'Check if dependency files changed'
+        id: should_run
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Check if dependency files changed using GitHub API
+          CHANGED_FILES=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files --jq '.[].filename')
+          if echo "$CHANGED_FILES" | grep -qE '^(package\.json|yarn\.lock)$'; then
+            echo "Dependency files changed - will run review"
+            echo "run=true" >> $GITHUB_OUTPUT
+          else
+            echo "No dependency changes - skipping review"
+            echo "run=false" >> $GITHUB_OUTPUT
+          fi
+      - name: 'Checkout repository'
+        if: steps.should_run.outputs.run == 'true'
+        uses: swan-bitcoin/actions/actions/checkout@master
+        with:
+          fetch-depth: 1
+          fetch-tags: false
+      - name: 'Dependency Review'
+        if: steps.should_run.outputs.run == 'true'
+        uses: swan-bitcoin/actions/actions/dependency-review-action@master
+        # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
+        with:
+          comment-summary-in-pr: on-failure
+          license-check: false
+          fail-on-severity: high
+        #   deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later
+        #   retry-on-snapshot-warnings: true
+
+  analyze-dependency-changes:
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      pull-requests: read
+    runs-on: ${{ vars.ACTIVE_RUNNER_LABEL }}
+    steps:
+      - name: 'Check if dependency files changed'
+        id: should_run
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Check if dependency files changed using GitHub API
+          CHANGED_FILES=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files --jq '.[].filename')
+          if echo "$CHANGED_FILES" | grep -qE '^(package\.json|yarn\.lock)$'; then
+            echo "Dependency files changed - will run analysis"
+            echo "run=true" >> $GITHUB_OUTPUT
+          else
+            echo "No dependency changes - skipping analysis"
+            echo "run=false" >> $GITHUB_OUTPUT
+          fi
+      - name: 'Checkout repository'
+        if: steps.should_run.outputs.run == 'true'
+        uses: swan-bitcoin/actions/actions/checkout@master
+        with:
+          fetch-depth: 1
+          fetch-tags: false
+      - name: 'Analyze Dependency Changes'
+        if: steps.should_run.outputs.run == 'true'
+        uses: swan-bitcoin/actions/swan/analyze-dependencies@master
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}