From 825583f224a9c3ad8294eef429714d3783d49606 Mon Sep 17 00:00:00 2001
From: Busiii-adetiba <divineadetiba46@gmail.com>
Date: Thu, 30 Jul 2026 11:42:51 +0000
Subject: [PATCH] ci(security): add dependency vulnerability scans

Closes: #125
---
 .github/workflows/android-ci.yml  |  3 +++
 .github/workflows/ios-ci.yml      | 10 ++++++++++
 android/build.gradle.kts          |  6 ++++++
 android/gradle/libs.versions.toml |  2 ++
 4 files changed, 21 insertions(+)

diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml
index f80df59..ce13880 100644
--- a/.github/workflows/android-ci.yml
+++ b/.github/workflows/android-ci.yml
@@ -35,6 +35,9 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
+      - name: Scan dependencies for high severity vulnerabilities
+        run: ./gradlew dependencyCheckAggregate
+
       - name: Assemble debug APK
         run: ./gradlew assembleDebug
 
diff --git a/.github/workflows/ios-ci.yml b/.github/workflows/ios-ci.yml
index 8d1ec1c..32032fd 100644
--- a/.github/workflows/ios-ci.yml
+++ b/.github/workflows/ios-ci.yml
@@ -115,6 +115,16 @@ jobs:
       - name: Resolve package dependencies
         run: xcodebuild -resolvePackageDependencies
 
+      - name: Show SwiftPM dependency graph
+        run: swift package show-dependencies
+
+      - name: Review dependency changes for high severity vulnerabilities
+        if: github.event_name == 'pull_request'
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          license-check: false
+
       # Runs the existing EthosProtocolTests XCTest target against the SPM
       # package (Package.swift) — deliberately BEFORE the Xcode project is
       # generated below (see below for why order matters).
diff --git a/android/build.gradle.kts b/android/build.gradle.kts
index 721a456..a53119d 100644
--- a/android/build.gradle.kts
+++ b/android/build.gradle.kts
@@ -5,4 +5,10 @@ plugins {
     alias(libs.plugins.kotlin.serialization) apply false
     alias(libs.plugins.hilt) apply false
     alias(libs.plugins.ksp) apply false
+    alias(libs.plugins.dependency.check)
+}
+
+dependencyCheck {
+    failBuildOnCVSS = 7.0F
+    formats = listOf("HTML", "JSON")
 }
diff --git a/android/gradle/libs.versions.toml b/android/gradle/libs.versions.toml
index 892eef0..4165ea3 100644
--- a/android/gradle/libs.versions.toml
+++ b/android/gradle/libs.versions.toml
@@ -18,6 +18,7 @@ room = "2.6.1"
 work = "2.10.0"
 security-crypto = "1.1.0-alpha06"
 paparazzi = "1.3.4"
+dependency-check = "12.2.2"
 
 [libraries]
 compose-bom = { group = "androidx.compose", name = "compose-bom", version.ref = "compose-bom" }
@@ -71,3 +72,4 @@ kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", versi
 hilt = { id = "com.google.dagger.hilt.android", version.ref = "hilt" }
 ksp = { id = "com.google.devtools.ksp", version = "2.1.0-1.0.29" }
 paparazzi = { id = "app.cash.paparazzi", version.ref = "paparazzi" }
+dependency-check = { id = "org.owasp.dependencycheck", version.ref = "dependency-check" }