Repository navigation

docs: add scoped PTP timing and failure-handling contract #34

	name: Dependency Review

	on:
	pull_request:
	branches: [ main, master ]

	permissions:
	contents: read
	pull-requests: write

	jobs:
	dependency-review:
	name: Dependency Review
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	# Preferred gate: evaluates dependency changes against GitHub's dependency graph.
	# Some repositories can have the graph unavailable/disabled. Treat that as a
	# capability failure, not as permission to skip dependency security validation.
	- name: GitHub dependency review
	id: github_dependency_review
	continue-on-error: true
	uses: actions/dependency-review-action@v4
	with:
	config-file: .github/dependency-review-config.yml

	- name: Setup .NET fallback
	if: steps.github_dependency_review.outcome == 'failure'
	uses: actions/setup-dotnet@v6
	with:
	dotnet-version: '8.0.x'

	- name: NuGet vulnerability audit fallback
	if: steps.github_dependency_review.outcome == 'failure'
	shell: bash
	run: \|
	set -euo pipefail
	echo "GitHub dependency review is unavailable or failed; enforcing NuGet audit fallback."
	dotnet restore ./PtpLabClock.sln \
	-p:NuGetAudit=true \
	-p:NuGetAuditMode=all \
	'-p:WarningsAsErrors=NU1901;NU1902;NU1903;NU1904'
	dotnet list ./PtpLabClock.sln package --vulnerable --include-transitive