test(security): align Dependency Review policy and conformance checks

[ademolabiyi92-design]

Summary

Makes the Dependency Review workflow contract explicit in the dependency policy and adds a focused static conformance suite. The actual workflow already matches the intended high-severity security gate; no workflow change is needed or included.

Related Issue

Closes #124

Scope

• Document the PR trigger/default events, no filters, read-only permissions, pinned action, timeout, high/critical threshold and maintainer expectations.
• Explain base/head dependency review versus a full existing-dependency audit, failed/missing check handling, separate ruleset enforcement and no auto-merge.
• Add 18 conformance tests, including mutations for privileged triggers, filters, write permissions, overrides, a weaker threshold, skipped/error-ignored jobs, extra inputs/steps and unpinned references.
• Compare the complete deliberately small workflow shape without adding a YAML parser dependency. Formatting/comments/CRLF are tolerated; executable contract changes require deliberate review.

Testing

The actual branch is blocked by pre-existing repository errors. At base dec3374008bcec02b58ca91b9a417866686b19c6, npm ci --ignore-scripts --no-audit --no-fund fails with EJSONPARSE: the audit:workflow-permissions entry in package.json is missing a comma. Separately, .github/workflows/ci.yml has an audit step outside steps, and a YAML parser reports errors at line 22. Neither protected file is changed by this PR.

To validate this change independently, I used a separate local copy with only that missing package.json comma repaired. These are qualified results, not claims that the PR branch passes repository checks:

Check in isolated copy	Result
Clean install with scripts disabled	Pass
npm test -- tests/dependency-review-policy.test.ts tests/dependabot-policy.test.ts tests/workflow-security.test.ts	26 tests pass after conformance updates
ESLint and Prettier on the new test file	Pass
Typecheck / build	Fail in unchanged source/tests: missing diagnostics bounds/types modules, outcome mismatches and redaction identifiers, among others
Full lint	21 existing errors outside the new file
Full formatting	135 existing files flagged (Windows checkout included)
Full test run before the final additional unpinned-reference case	20 suites pass / 59 fail; 805 tests pass / 17 fail / 9 skipped. New policy tests pass.

git diff --check passes on the contribution branch. Dependency Review YAML parses without errors; the workflow is unchanged. Repository-wide checks remain blocked and this PR is not represented as merge-ready. The isolated package repair is not committed. Please address the main-branch baseline separately, then rerun the full gates.

• Tests added/updated where applicable
• Existing relevant tests pass (qualified isolated-copy results above)
• Lint/type/build checks pass where available (baseline failures above)

Security Impact

• No security-sensitive behavior is changed
• Security-sensitive behavior is changed and explained below

Security notes: supply-chain documentation and tests only; no permission changes, threshold changes, gate bypasses, exceptions, workflow edits, auto-merge or new dependencies. Maintainer supply-chain review requested by issue scope.

Release Impact

• No published/user-visible behavior change
• Patch
• Minor
• Breaking/pre-1.0 contract change
• Changeset included where required
• Changeset not required; reason explained below

Release notes: contributor docs/tests only, no shipped CLI behavior change.

Documentation

• Documentation updated where applicable
• No documentation change required

Checklist

• I read docs/contributing/wave-architecture.md for Stellar Wave work
• I stayed within the agreed issue scope
• I checked for overlapping open contributor PRs
• I did not include secrets or sensitive data
• I reviewed new/updated dependencies if any (none)
• I considered failure/error paths, not only the happy path
• I am not disclosing an unresolved vulnerability publicly

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 06ee8d14-184d-442c-acfb-9cec841f558a

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}