[HARD][SUPPLY CHAIN] Add dependency governance, SBOM, secret scanning, and release security gates #79

Overview

Harden the software supply chain so vulnerable, malicious, unreviewed, or secret-containing changes cannot quietly enter ChainMove releases.

Problem

The project contains a large frontend/backend dependency tree, multiple lockfiles, blockchain libraries, payment integrations, and CI workflows. Dependency drift or compromised packages can expose user data and financial operations.

Scope

• Standardize the supported package manager and remove or document conflicting lockfiles.
• Add automated dependency vulnerability scanning with severity and exception policies.
• Generate a software bill of materials (SBOM) for release builds.
• Add secret scanning for commits, pull requests, build output, and common key formats.
• Pin GitHub Actions to immutable versions/SHAs and minimize workflow permissions.
• Add dependency-review checks for new transitive packages and license policy.
• Detect install scripts, typosquatting risks, abandoned packages, and unexpected binary artifacts.
• Add reproducibility checks for clean installs and production builds.
• Define a signed release/provenance strategy where supported.
• Add an auditable exception file with owner, reason, expiry, and remediation date.

Acceptance criteria

• CI blocks unapproved critical vulnerabilities and detected secrets.
• SBOM artifacts are produced without exposing environment values.
• Workflow tokens use least privilege.
• Dependency exceptions expire and cannot be permanent undocumented bypasses.
• Clean installs use one authoritative lockfile and produce consistent builds.
• Contributor forks cannot access trusted deployment secrets.

Tests/evidence required

Demonstrate detection of a seeded fake secret, a vulnerable test dependency, an unpinned workflow action, an expired exception, and lockfile drift.

Documentation

Add dependency update, vulnerability response, and emergency patch procedures.

Difficulty

Hard