feat: add dependency-cooldown

[dewabisma]

Summary

Added workflow that check direct and transitive dependencies age

[n13]

Reviewer model: GPT Sol

Verdict: REQUEST_CHANGES — the scheduled audit cannot complete on this repository, and the pull-request check is not configured as a required merge gate.

Findings:

• High — Require the cooldown status on main. .github/workflows/dependency-cooldown.yml:13 creates dependency-cooldown / Dependency cooldown, but the effective rules for main contain only deletion, non-fast-forward, and one-approval pull-request rules; neither the ruleset nor branch protection has a required-status-check rule. A dependency PR can therefore still be merged when this security check fails. Add the cooldown job as a required status check in the active main ruleset before treating the gate as enforced.

• High — Fix the scheduled audit's handling of the existing local tarball. .github/workflows/dependency-cooldown-audit.yml:12 invokes the current shared-workflows@v1 audit over all locked versions. On this exact head, bun.lock:1522 records human-readable-checksum@./package/human-readable-checksum-0.3.0.tgz; the Bun parser does not recognize the relative tarball specifier as non-registry, queries https://registry.npmjs.org/human-readable-checksum, receives HTTP 404, and exits 2. As a result, every weekly or manual audit will fail before producing the intended age report. Fix and publish the shared parser so relative/local archive specs are reported as uncheckable, or omit this audit caller until that fix is available.

Validation:

• Reviewed the full diff from c66e017422ad7f395c84a0935fb4e90c567e66f7 to 116f08befddf92df6347d6d87df833c6a3858889; git diff --check passed.
• actionlint passed for both new workflow files.
• The live Build and Test and pull-request cooldown jobs pass; the shared action's check mode also passed locally with zero introduced versions.
• The shared action's audit mode scanned 1,500 locked versions and reproduced the npm 404/exit-2 failure above.

[dewabisma]

High — Require the cooldown status on main. .github/workflows/dependency-cooldown.yml:13 creates dependency-cooldown / Dependency cooldown, but the effective rules for main contain only deletion, non-fast-forward, and one-approval pull-request rules; neither the ruleset nor branch protection has a required-status-check rule. A dependency PR can therefore still be merged when this security check fails. Add the cooldown job as a required status check in the active main ruleset before treating the gate as enforced.

We will fix this later to enforce it in the repo rule set because I don't have permission.

[dewabisma]

High — Fix the scheduled audit's handling of the existing local tarball. .github/workflows/dependency-cooldown-audit.yml:12 invokes the current shared-workflows@v1 audit over all locked versions. On this exact head, bun.lock:1522 records human-readable-checksum@./package/human-readable-checksum-0.3.0.tgz; the Bun parser does not recognize the relative tarball specifier as non-registry, queries https://registry.npmjs.org/human-readable-checksum, receives HTTP 404, and exits 2. As a result, every weekly or manual audit will fail before producing the intended age report. Fix and publish the shared parser so relative/local archive specs are reported as uncheckable, or omit this audit caller until that fix is available.

Have fixed it in the shared workflows repo.

[n13]

Reviewer model: GPT Sol

Verdict: REQUEST_CHANGES — the shared audit failure is fixed, but the cooldown check is still not enforced as a merge requirement.

Finding:

• High — Require the cooldown status on main. .github/workflows/dependency-cooldown.yml:13 creates dependency-cooldown / Dependency cooldown, but the live active protect-main ruleset and branch protection still contain no required status check. A pull request that introduces a dependency inside the cooldown window can therefore show a failing check and still be merged, so the intended gate fails open. Add this exact status as a required check in the active main ruleset before merging; this may need to be done by a repository or organization administrator.

Validation:

• Reviewed the complete diff from c66e017422ad7f395c84a0935fb4e90c567e66f7 to 116f08befddf92df6347d6d87df833c6a3858889; git diff --check passed.
• actionlint v1.7.7 passed for both new workflow files.
• Re-ran the current shared-workflows@v1 bundle (32aabd71d49df3482e4721eeb3f3d6fb5918850f): check mode passed with zero introduced versions, and audit mode successfully checked 1,499 locked versions. This confirms the earlier local-tarball/404 blocker is resolved.
• The live Build and Test and pull-request cooldown jobs pass. The repository ruleset and branch-protection APIs confirm that no required-status-check rule exists.

[n13]

AI review nagging, will be fixed on main