ci: add dependency vulnerability scans

.github/workflows/android-ci.yml

@@ -35,6 +35,9 @@ jobs:
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
 
+      - name: Scan dependencies for high severity vulnerabilities
+        run: ./gradlew dependencyCheckAggregate
+
       - name: Assemble debug APK
         run: ./gradlew assembleDebug
 

.github/workflows/ios-ci.yml

@@ -115,6 +115,16 @@ jobs:
       - name: Resolve package dependencies
         run: xcodebuild -resolvePackageDependencies
 
+      - name: Show SwiftPM dependency graph
+        run: swift package show-dependencies
+
+      - name: Review dependency changes for high severity vulnerabilities
+        if: github.event_name == 'pull_request'
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          license-check: false
+
       # Runs the existing EthosProtocolTests XCTest target against the SPM
       # package (Package.swift) — deliberately BEFORE the Xcode project is
       # generated below (see below for why order matters).

android/build.gradle.kts

@@ -5,4 +5,10 @@ plugins {
     alias(libs.plugins.kotlin.serialization) apply false
     alias(libs.plugins.hilt) apply false
     alias(libs.plugins.ksp) apply false
+    alias(libs.plugins.dependency.check)
+}
+
+dependencyCheck {
+    failBuildOnCVSS = 7.0F
+    formats = listOf("HTML", "JSON")
 }

android/gradle/libs.versions.toml

@@ -18,6 +18,7 @@ room = "2.6.1"
 work = "2.10.0"
 security-crypto = "1.1.0-alpha06"
 paparazzi = "1.3.4"
+dependency-check = "12.2.2"
 
 [libraries]
 compose-bom = { group = "androidx.compose", name = "compose-bom", version.ref = "compose-bom" }
@@ -71,3 +72,4 @@ kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", versi
 hilt = { id = "com.google.dagger.hilt.android", version.ref = "hilt" }
 ksp = { id = "com.google.devtools.ksp", version = "2.1.0-1.0.29" }
 paparazzi = { id = "app.cash.paparazzi", version.ref = "paparazzi" }
+dependency-check = { id = "org.owasp.dependencycheck", version.ref = "dependency-check" }