Harden dependency-validation workflow

[ranuka-laksika]

Purpose

Fixes the Dependency Validation workflow, which was failing at checkout and carried a security risk.

Changes

• Remove the unsafe fork checkout. The pull_request_target job checked out fork code via head.sha with allow-unsafe-pr-checkout: true, exposing the trusted GITHUB_TOKEN and secrets to untrusted PR code (a "pwn request" risk). It now checks out the base repo and fetches the PR head as a git ref, so the fork's go.mod is analyzed as data and never executed.
• Fix invalid fetch depth. Removed --depth=0 (not a valid depth); full history is already available via fetch-depth: 0 on the checkout step.
• Bump actions/github-script from v7 to v8 to run on Node 24 and clear the Node 20 deprecation warning.

No change to the validation logic or PR-gating behavior.

Summary by CodeRabbit

• Bug Fixes
  • Improved dependency validation for pull requests from forked repositories.
  • Validation now compares dependency file changes safely against the pull request base.
  • Updated pull request validation comments to use the latest supported scripting action.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8826c9a6-6b7a-4d4f-8aa5-8c673b887b5e

📥 Commits

Reviewing files that changed from the base of the PR and between eb969e9 and 08fdf60.

📒 Files selected for processing (1)

• .github/workflows/dependency-validation.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/dependency-validation.yml

---

📝 Walkthrough

Walkthrough

The dependency validation workflow fetches and verifies the PR head, compares dependency files against the base commit, and updates validation comment steps to actions/github-script@v8.

Changes

Dependency validation workflow

Layer / File(s)	Summary
Safe PR diff and comment actions .github/workflows/dependency-validation.yml	The workflow fetches the PR head into pr-head, verifies its SHA, diffs it against the base SHA, and updates both comment steps to actions/github-script@v8.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description includes Purpose and Changes, but omits most required template sections such as Goals, Approach, tests, security checks, and release notes.	Add the missing template sections: Goals, Approach, User stories, Release note, Documentation, tests, Security checks, and the other requested fields.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: hardening the dependency-validation workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/dependency-validation.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/dependency-validation.yml:
- Around line 32-42: Update the “Fetch PR head as data” and “Detect modified
go.mod files” workflow steps to resolve and use a single PR head SHA: capture
the fetched ref’s SHA, compare it with github.event.pull_request.head.sha, and
fail immediately on mismatch. Pass the verified resolved SHA into the validation
step so change detection and validation inspect the same commit.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a16d33c9-1067-4836-a217-4a7efa8dee5d

📥 Commits

Reviewing files that changed from the base of the PR and between 3234cc6 and eb969e9.

📒 Files selected for processing (1)

• .github/workflows/dependency-validation.yml