From 9bd31fdb8fcb98e3a22917f61283c0ac709360ea Mon Sep 17 00:00:00 2001
From: XV <xv@acg.box>
Date: Sun, 19 Jul 2026 09:04:57 -0400
Subject: [PATCH] {"schema":"decodex/commit/2","change":"Add centralized
 dependency review","authority":"manual","impact":"compatible"}

---
 .github/workflows/dependency-review.yml | 28 +++++++++++++++++++++++++
 README.md                               | 17 +++++++++++++--
 2 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/dependency-review.yml

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..521c192
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,28 @@
+name: Dependency Review
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          base-ref: ${{ github.event.merge_group.base_sha }}
+          head-ref: ${{ github.event.merge_group.head_sha }}
+          fail-on-severity: high
+          license-check: false
+          retry-on-snapshot-warnings: true
+          show-patched-versions: true
diff --git a/README.md b/README.md
index 0d6839e..0b44bdb 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,15 @@
-# .github
-Organization-wide GitHub configuration and required workflows
+# acg-box GitHub configuration
+
+This repository contains centrally managed GitHub configuration for the
+`acg-box` organization.
+
+## Required workflows
+
+The enterprise `dependency-review` ruleset runs
+`.github/workflows/dependency-review.yml` for pull requests and merge queues in
+every targeted repository. It blocks changes that introduce dependencies with
+known high or critical vulnerabilities. Lower-severity findings remain visible
+in the workflow report without blocking the merge.
+
+The workflow is maintained only in this repository; individual repositories do
+not need caller workflows.