Add Dependency Review GitHub Action

.github/dependency-review-config.yml

@@ -0,0 +1,36 @@
+# Permissive licenses
+allow-licenses:
+  - MIT
+  - MIT-0
+  - Apache-2.0
+  - BSD-2-Clause
+  - BSD-2-Clause-Views
+  - BSD-3-Clause
+  - ISC
+  - PSF-2.0
+  - Python-2.0
+  - CNRI-Python
+  - 0BSD
+  - BlueOak-1.0.0
+  - CC0-1.0
+  - CC-BY-3.0
+  - CC-BY-4.0
+  - Unlicense
+  - NCSA
+  - ZPL-2.1
+  - HPND-Markus-Kuhn
+  - Artistic-2.0
+  - Artistic-1.0-Perl
+  # Permissive licenses without official SPDX IDs (ScanCode identifiers)
+  - LicenseRef-scancode-public-domain
+  - LicenseRef-scancode-public-domain-disclaimer
+  - LicenseRef-scancode-protobuf
+  # Weak copyleft (LGPL/MPL) — safe as libraries in commercial software
+  - MPL-2.0
+  - LGPL-2.1-only
+  - LGPL-2.1-or-later
+  - LGPL-3.0-only
+  - LGPL-3.0-or-later
+  - LGPL-3.0
+
+fail-on-severity: high

.github/workflows/dependency-review.yml

@@ -0,0 +1,31 @@
+name: Dependency Review
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      base-ref:
+        description: Base git ref for comparison (e.g. a tag or commit SHA)
+        required: true
+      head-ref:
+        description: Head git ref for comparison (defaults to HEAD)
+        required: false
+        default: HEAD
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          base-ref: ${{ inputs.base-ref || '' }}
+          head-ref: ${{ inputs.head-ref || '' }}
+          config-file: ./.github/dependency-review-config.yml