chore(deps): Included dependency review

[naveensrinivasan]

Dependency Review GitHub Action in your repository to enforce dependency reviews on your pull requests.
The action scans for vulnerable versions of dependencies introduced by package version changes in pull requests,
and warns you about the associated security vulnerabilities.
This gives you better visibility of what's changing in a pull request,
and helps prevent vulnerabilities being added to your repository.

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
Signed-off-by: naveensrinivasan [email protected]

[codecov-commenter]

Codecov Report

Merging #788 (5fe704a) into main (ed3b98f) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #788   +/-   ##
=======================================
  Coverage   47.56%   47.56%           
=======================================
  Files          62       62           
  Lines        5460     5460           
=======================================
  Hits         2597     2597           
  Misses       2558     2558           
  Partials      305      305           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ed3b98f...5fe704a. Read the comment docs.

[asraa]

Thanks! Could you please add version comments to the pinned actions? e.g.

rekor/.github/workflows/build.yml

Line 55 in e0b7916

uses: google-github-actions/auth@b258a9f230b36c9fa86dfaa43d1906bd76399edb # v0.7.1

[naveensrinivasan]

Thanks! Could you please add version comments to the pinned actions? e.g.

rekor/.github/workflows/build.yml

Line 55 in e0b7916

uses: google-github-actions/auth@b258a9f230b36c9fa86dfaa43d1906bd76399edb # v0.7.1

The dependabot doesn't update the version. It becomes obsolete, and that is why I didn't add one. Let me know.

[cpanato]

usually i update the dependabot pr to update the version

[naveensrinivasan]

usually i update the dependabot pr to update the version

I can add the version. If that is required.

usually i update the dependabot pr to update the version

Included the version.

[naveensrinivasan]

@cpanato A friendly ping to merge.