Harden dependency-validation workflow

[ranuka-laksika]

Purpose

Fixes the Dependency Validation workflow, which was failing at checkout and carried a security risk.

Changes

• Remove the unsafe fork checkout. The pull_request_target job checked out fork code via head.sha, exposing the trusted GITHUB_TOKEN and secrets to untrusted PR code (a "pwn request" risk). It now checks out the base repo and fetches the PR head as a git ref, so the fork's go.mod is analyzed as data and never executed.
• Single, verified head SHA. Detection and validation now both use the event-pinned head.sha; the fetched ref is verified to match it, and the job fails fast if the PR head moved after the trigger.
• Bump actions. actions/checkout v4 → v6 and actions/github-script v7 → v8 (runs on Node 24, clears the Node 20 deprecation warning).

No change to the validation logic or PR-gating behavior.

Summary by CodeRabbit

Summary by CodeRabbit

• Bug Fixes

  • Improved dependency validation reliability by adding a check that the pull request commit remains unchanged throughout the run.
  • Failed validation earlier if the pull request head differs from what was expected.

• Chores

  • Updated automation tooling to newer workflow action versions for more consistent validation and status comment reporting.

[coderabbitai]

📝 Walkthrough

Walkthrough

The dependency validation workflow now uses newer GitHub Actions versions and verifies that the fetched PR head commit matches the event-provided SHA before continuing with dependency validation.

Changes

Dependency validation workflow

Layer / File(s)	Summary
PR head validation and action updates .github/workflows/dependency-validation.yml	The workflow fetches the PR head into pr-head, compares it with the triggering commit SHA, updates both checkout actions to v6, and updates PR comment steps to github-script@v8.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubEvent
  participant DependencyValidation
  participant Git
  participant ValidationSteps
  GitHubEvent->>DependencyValidation: Provide pull_request.head.sha
  DependencyValidation->>Git: Fetch PR head into pr-head
  Git-->>DependencyValidation: Return fetched commit SHA
  DependencyValidation->>DependencyValidation: Compare fetched SHA with event SHA
  DependencyValidation->>ValidationSteps: Continue when commits match

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers purpose and changes, but it omits several template sections like Approach, Checklist, Related Issues, and Security checks.	Add the missing template sections: Approach, Related Issues, Related PRs, Checklist, and Security checks; include breaking changes details if applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately captures the main change: hardening the dependency-validation workflow.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ThaminduDilshan]

@ranuka-laksika can you rebase and force push?