Enforce severity and license gates in dependency-review workflow

.github/workflows/dependency-review.yml

@@ -9,7 +9,18 @@
 # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 name: 'Dependency review'
 on:
-  pull_request:
+  # Use pull_request_target so the review also works for PRs opened from forks.
+  # A plain `pull_request` run from a fork receives a read-only GITHUB_TOKEN, so
+  # `comment-summary-in-pr` cannot post its summary ("Unable to write summary to
+  # pull-request. Make sure you are giving this workflow the permission
+  # 'pull-requests: write'"). pull_request_target runs in the base-repo context
+  # with a read/write token, so the summary is posted on fork PRs too.
+  #
+  # This is safe here because dependency-review-action never checks out or executes
+  # PR-supplied code: it only compares the PR's base/head via the GitHub
+  # dependency-graph/advisory API. No checkout step is used, so untrusted code is
+  # never run with the elevated token.
+  pull_request_target:
     branches: [ "main" ]
 
 # Cancel superseded runs for the same PR to save runner minutes.
@@ -25,21 +36,23 @@ concurrency:
 # https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
 permissions:
   contents: read
-  # Write permissions for pull-requests are required for using the `comment-summary-in-pr` option, comment out if you aren't using this option
+  # Required so `comment-summary-in-pr` can post the review summary (works for
+  # fork PRs only because of the pull_request_target trigger above).
   pull-requests: write
 
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - name: 'Checkout repository'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
         with:
           comment-summary-in-pr: always
-        #   fail-on-severity: moderate
-        #   deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later
-        #   retry-on-snapshot-warnings: true
+          # Fail the PR when it introduces a vulnerability at or above this severity.
+          fail-on-severity: high
+          # Block copyleft / incompatible licenses that conflict with this MIT project.
+          deny-licenses: GPL-1.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, AGPL-3.0-or-later
+          # Snapshot dependency data can lag right after a push; retry instead of failing spuriously.
+          retry-on-snapshot-warnings: true