Fix dependency review snapshot warnings on PR heads

[Copilot]

Canonical issue

Outcome

Dependency Review was running on PRs without a matching head snapshot, so it could emit snapshot warnings and scan no files. This change makes the workflow submit the PR-head dependency snapshot first, then retry long enough for the review to diff the intended branch state.

Scope

• Included:
  • Workflow behavior
    • dependency-review.yml now checks out github.event.pull_request.head.sha instead of the synthetic merge ref.
    • Same-repo PRs submit a dependency snapshot for the head SHA before actions/dependency-review-action runs.
    • Dependency Review now enables snapshot-warning retry with a 300s timeout.
  • Regression coverage
    • Added a focused unit test that pins the head-SHA checkout, dependency submission step, and retry configuration.
  • Relevant workflow shape

    - name: Checkout code
      uses: actions/checkout@v7
      with:
        ref: ${{ github.event.pull_request.head.sha }}
    
    - name: Submit dependency snapshots
      if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
      uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4
      with:
        snapshot-sha: ${{ github.event.pull_request.head.sha }}
        snapshot-ref: ${{ format('refs/heads/{0}', github.event.pull_request.head.ref) }}
    
    - name: Dependency Review
      uses: actions/dependency-review-action@v5
      with:
        retry-on-snapshot-warnings: true
        retry-on-snapshot-warnings-timeout: 300

• Explicitly excluded:
  • Broader CI/workflow refactors
  • License/advisory policy changes
  • Fork-PR privilege expansion beyond the existing same-repo guard

Risk

• Risk level: low
• Failure mode:
  • Dependency submission does not populate in time and Dependency Review still warns, but the workflow remains scoped to PR-time supply-chain checks only.
• Rollback:
  • Revert dependency-review.yml and tests/unit/test_dependency_review_workflow.py.

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests — python3 -m pytest --override-ini addopts='' tests/unit/test_dependency_review_workflow.py tests/unit/test_workflow_pr_gate_coverage.py -q on c487ae2
• Required CI
• Review threads resolved

Production evidence

Not applicable. This change is limited to GitHub Actions dependency-review behavior and does not affect runtime or deployment paths.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes <h1>Dependency Review</h1> #1827

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Building	Preview, v0	Sep 9, 2026 6:44pm UTC