Fix dependency review snapshot warnings on PR heads

.github/workflows/dependency-review.yml

@@ -27,13 +27,28 @@ concurrency:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Submit dependency snapshots
+        if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4
+        with:
+          snapshot-sha: ${{ github.event.pull_request.head.sha }}
+          snapshot-ref: ${{ format('refs/heads/{0}', github.event.pull_request.head.ref) }}
 
       - name: Dependency Review
         uses: actions/dependency-review-action@v5
         with:
+          retry-on-snapshot-warnings: true
+          retry-on-snapshot-warnings-timeout: 300
           fail-on-severity: moderate
           # GHSA-w5hq-g745-h8pq: transitive uuid@8.3.2 pulled by next-auth@4.24 (which pins uuid ^8.3.2).
           # The moderate advisory affects uuid v3/v5/v6 when a caller-provided buffer is passed; next-auth

tests/unit/test_dependency_review_workflow.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+WORKFLOW_PATH = Path(__file__).resolve().parents[2] / ".github/workflows/dependency-review.yml"
+
+
+def _load_workflow() -> dict:
+    assert WORKFLOW_PATH.exists(), "dependency-review workflow should exist"
+    workflow = yaml.safe_load(WORKFLOW_PATH.read_text())
+    return workflow if "on" in workflow else {**workflow, "on": workflow[True]}
+
+
+def test_dependency_review_submits_pr_head_snapshot_and_retries_warnings() -> None:
+    workflow = _load_workflow()
+    job = workflow["jobs"]["dependency-review"]
+    steps = job["steps"]
+
+    checkout = next(step for step in steps if step["name"] == "Checkout code")
+    assert checkout["with"]["ref"] == "${{ github.event.pull_request.head.sha }}"
+
+    submission = next(
+        step
+        for step in steps
+        if step.get("uses", "").startswith(
+            "advanced-security/component-detection-dependency-submission-action@"
+        )
+    )
+    assert submission["if"] == (
+        "${{ github.event.pull_request.head.repo.full_name == github.repository }}"
+    )
+    assert submission["with"]["snapshot-sha"] == "${{ github.event.pull_request.head.sha }}"
+    assert submission["with"]["snapshot-ref"] == (
+        "${{ format('refs/heads/{0}', github.event.pull_request.head.ref) }}"
+    )
+
+    review = next(step for step in steps if step["name"] == "Dependency Review")
+    assert review["with"]["retry-on-snapshot-warnings"] is True
+    assert review["with"]["retry-on-snapshot-warnings-timeout"] == 300