Add dependency scan for Ruby, npm, Docker, and GitHub Actions

[zinduolis]

Pull Request

Thanks for submitting a PR! Please fill in this template where appropriate:

Category

CI / Tooling (GitHub Actions workflow)

Feature/Issue Description

Q: Please give a brief summary of your feature/fix

A: Adds a non-blocking GitHub Actions workflow that scans the project's dependencies for vulnerabilities and outdated versions on every PR to master, covering all the technologies the project uses — Ruby gems, npm packages, the Dockerfile, and the GitHub Actions workflows. Findings are reported to the run's Step Summary. Scan steps never fail the build, so the PR check stays green even when issues are found.

Q: Give a technical rundown of what you have changed (if applicable)

A: Adds .github/workflows/dependency-scan.yml — a single job on ubuntu-latest, triggered by pull_request to master, with least-privilege permissions: contents: read:

• Ruby gems — bundler-audit (DB refreshed first) for vulnerabilities, bundle outdated for currency.
• npm packages — npm audit and npm outdated (deps here are dev-only tooling: eslint/jsdoc).
• Dockerfile — hadolint (checksum-pinned binary).
• GitHub Actions — actionlint (checksum-pinned binary).
• Reporting — all output aggregated into $GITHUB_STEP_SUMMARY.

Setup/prep steps (downloads, checksum verification, bundle audit update, npm ci) fail loudly so a broken environment can't produce a silent false pass, while the scan commands use || true to stay non-blocking. All uses: actions are pinned to full commit SHAs (with version comments) and both binaries are SHA256-verified.

Test Cases

Q: Describe your test cases, what you have covered and if there are any use cases that still need addressing.

A: Validated the workflow YAML syntax and verified on a test PR to master that the run completes green even when vulnerabilities/outdated dependencies are present, with all four sections (Ruby, npm, Dockerfile, GitHub Actions) rendering in the Summary tab. Confirmed checksum mismatches and prep failures fail their step rather than passing silently. Not yet addressed: binary checksums are pinned to the current linux x86_64/amd64 assets (a runner arch change would require updating them), and findings surface only in the Step Summary, which is the intended scope.

Wiki Page

N/A — the workflow is self-contained and documented via inline comments and this PR.