/.github/workflows/dependency-test.yml: improve security hygiene

[coffeegoddd]

No description provided.

[Copilot]

Pull request overview

Updates the dependency-test GitHub Actions workflow to tighten default token permissions and make it work for both pull_request and issue_comment triggers by resolving the PR SHA/number in a dedicated step.

Changes:

• Adds explicit workflow permissions for improved security hygiene.
• Normalizes PR SHA/number resolution across pull_request and issue_comment events and reuses those outputs in subsequent API calls.
• Disables persisted Git credentials during checkout.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The workflow now sets explicit permissions, but later steps call the Issues API (/issues/.../comments). With the current permissions (contents: read, pull-requests: read), GITHUB_TOKEN may not be allowed to read issue comments, causing those curl calls to fail with 403. Add issues: read (or broaden to read-all if preferred) to match the API usage in this workflow.

Suggested change

	pull-requests: read
	pull-requests: read
	issues: read

[Copilot]

The job-level if condition uses github.event.issue.pull_request != '' to detect PR comments. For issue_comment events on regular issues, github.event.issue.pull_request is typically missing/null, and null != '' can evaluate truthy, unintentionally running this job for non-PR issues (and then the API calls will hit /pulls/<issue_number> and fail). Use an existence check like github.event.issue.pull_request or an explicit null comparison instead of comparing to the empty string.

Suggested change

	if: github.event_name == 'pull_request' || (github.event_name == 'issue_comment' && github.event.issue.pull_request != '')
	if: github.event_name == 'pull_request' || (github.event_name == 'issue_comment' && github.event.issue.pull_request != null)

[Copilot]

Resolve PR ref relies on curl -s and then blindly parses .head.sha with jq. If the API request returns a non-2xx (e.g., 404/403 due to permissions) curl can still exit 0 and jq will produce null, which would propagate into actions/checkout as an invalid ref. Make the API call fail on HTTP errors (e.g., curl -f) and validate that the parsed SHA is non-empty/non-null before writing to $GITHUB_OUTPUT.

Suggested change

	PR_DATA=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
	https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.issue.number }})
	SHA=$(echo "$PR_DATA" | jq -r '.head.sha')
	PR_DATA=$(curl -fsS -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
	https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.issue.number }})
	SHA=$(echo "$PR_DATA" | jq -r '.head.sha // empty')
	if [ -z "$SHA" ]; then
	echo "Failed to resolve PR head SHA from GitHub API response." >&2
	exit 1
	fi

[Copilot]

actions/checkout is configured with persist-credentials: false, but a later step runs git fetch --all --unshallow / merges origin/main. With credentials removed, those subsequent git network operations can fail on private repos (and can be flaky if GitHub ever requires auth). Either keep credentials persisted for this job, or adjust the later fetch/merge to authenticate explicitly without relying on persisted checkout credentials.

Suggested change

	persist-credentials: false
	persist-credentials: true