Add dependency vulnerability scan CI gates

[negillett]

Summary

• Add deps-scan workflow with pip-audit, OSV-Scanner, and allowlist expiry.
• Add Dependabot weekly groups for pip and GitHub Actions.

Test plan

• bash ./scripts/check-deps-allowlist.sh
• pip-audit --desc on

Review

No blocking findings.

[cursor]

PR Summary

Medium Risk
Introduces new CI jobs that can block merges on dependency scan findings or allowlist expiry, so misconfiguration or output-parsing edge cases could cause unexpected build failures.

Overview
Adds a new deps-scan GitHub Actions workflow that enforces dependency security checks on PRs, main, and a weekly schedule: it validates a time-bounded dependency vulnerability allowlist, runs pip-audit, and runs an OSV-Scanner gate that fails only on High/Critical findings.

Introduces Dependabot weekly update configuration (grouped patch vs minor/major for pip, plus grouped GitHub Actions updates), adds initial .github/deps-allowlist.yml and .osv-scanner.toml, and refactors allowlist expiry validation by extracting a reusable scripts/check-allowlist-expiry.sh used by both CodeQL and dependency allowlists.

^{Reviewed by Cursor Bugbot for commit d47b605. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 021bb03. Configure here.}

[cursor]

Unrecognized osv-scanner flag may silently pass gate

High Severity

The --allow-no-lockfiles flag does not appear in any osv-scanner v2 documentation, CLI reference, changelog, or source code. The documented approach for handling missing lockfiles in v2 is --include-git-root. If the flag is unrecognized, osv-scanner exits with code 1 (cobra default for unknown flags). The status -gt 1 check on line 55 does not catch exit code 1, so execution falls through to the Python parser, which finds no severity summary or vulnerability IDs in the error text and prints "PASS" — a false pass where the scanner never actually ran.

 

^{Reviewed by Cursor Bugbot for commit 021bb03. Configure here.}