Harden release integrity, licensing, and provenance #71

	name: Dependency security review

	on:
	pull_request:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: dependency-security-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	env:
	DOTNET_NOLOGO: true
	DOTNET_CLI_TELEMETRY_OPTOUT: true

	jobs:
	nuget-audit:
	name: NuGet vulnerability audit
	runs-on: ubuntu-24.04
	timeout-minutes: 8

	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

	- name: Setup .NET
	uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
	with:
	dotnet-version: 8.0.4xx

	- name: Run high/critical vulnerability audit
	id: nuget-audit
	continue-on-error: true
	shell: bash
	run: \|
	set -o pipefail
	dotnet restore ./ProcessBusSuite.sln \
	-p:AuditPipeline=true \
	-p:EnableWindowsTargeting=true \
	2>&1 \| tee nuget-audit.log

	- name: Upload audit evidence
	if: always()
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
	with:
	name: nuget-audit-${{ github.run_id }}
	path: nuget-audit.log
	if-no-files-found: error
	retention-days: 14

	- name: Enforce audit result
	if: steps.nuget-audit.outcome != 'success'
	shell: bash
	run: \|
	echo "NuGet high/critical vulnerability audit failed. See the uploaded nuget-audit artifact."
	exit 1

	github-dependency-review:
	name: GitHub dependency delta review
	runs-on: ubuntu-24.04
	timeout-minutes: 6

	steps:
	- name: Review dependency changes
	uses: actions/dependency-review-action@v5
	with:
	fail-on-severity: high
	retry-on-snapshot-warnings: true
	retry-on-snapshot-warnings-timeout: 180

Provide feedback