feat(scripts): add dependency pinning compliance scanning

[WilliamBerryiii]

Pull Request

Description

Add dependency pinning compliance scanning infrastructure migrated from microsoft/hve-core. This introduces a PowerShell-based scanner that detects unpinned GitHub Actions, npm packages, pip requirements, and shell download commands across the repository. The scanner produces compliance reports in JSON, SARIF, CSV, Markdown, and table formats, integrates with GitHub Actions CI/CD pipelines, and includes comprehensive Pester test coverage.

Key additions:

• Test-DependencyPinning.ps1 main scanner with SHA pinning validation, npm dependency analysis, shell download security checks, and multi-format compliance reporting
• SecurityClasses.psm1 and SecurityHelpers.psm1 shared modules providing typed classes, structured logging, GitHub API integration with retry/backoff, and security report generation
• tool-checksums.json checksum registry for actionlint and gitleaks binaries
• Three GitHub Actions workflows: dependency-pinning-scan.yml (scheduled + manual), pester-tests.yml (CI test runner), plus updates to main.yml and pr-validation.yml
• 121 Pester unit tests across Test-DependencyPinning.Tests.ps1 and SecurityHelpers.Tests.ps1 with GitMocks.psm1 test infrastructure and 16 fixture files

Closes #58

Type of Change

• ✨ New feature (non-breaking change adding functionality)

Component(s) Affected

• scripts/security/ - Dependency pinning scanner and shared modules
• scripts/tests/ - Pester test suite, fixtures, and mocks
• .github/workflows/ - CI/CD pipeline workflows

Testing Performed

• Pester test suite executed — 121/121 tests passed
• PSScriptAnalyzer ran — zero errors, zero warnings
• Scanner executed locally against repository — compliance report generated

Checklist

• My code follows the project conventions
• Commit messages follow conventional commit format
• I have performed a self-review
• Documentation updated as needed
• No new linting warnings introduced

[Copilot]

Pull request overview

This PR adds comprehensive dependency pinning compliance scanning infrastructure to detect unpinned GitHub Actions, npm packages, pip requirements, and shell download commands. The implementation includes a PowerShell-based scanner with SHA pinning validation, multi-format reporting (JSON, SARIF, CSV, Markdown), GitHub Actions CI/CD workflow integration, and 121 Pester unit tests achieving broad code coverage.

Changes:

• Security scanning script Test-DependencyPinning.ps1 with support for GitHub Actions, npm, pip, and shell download validation
• Shared security modules (SecurityClasses.psm1, SecurityHelpers.psm1) providing typed classes, logging, GitHub API integration with retry/backoff, and report generation
• Three GitHub Actions workflows for automated scanning, Pester testing, and integration with existing CI pipelines
• Comprehensive test suite with 121 unit tests, mock infrastructure, and 16 fixture files

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/security/Test-DependencyPinning.ps1	Main dependency scanner with SHA validation, npm/pip/shell analysis, and compliance reporting
scripts/security/Modules/SecurityClasses.psm1	Typed PowerShell classes for violations and compliance reports
scripts/security/Modules/SecurityHelpers.psm1	Shared utilities for logging, GitHub API calls, and report generation
scripts/security/tool-checksums.json	Checksum registry for actionlint and gitleaks binaries
scripts/tests/security/Test-DependencyPinning.Tests.ps1	712-line test suite with 80+ unit tests for scanner functions
scripts/tests/security/SecurityHelpers.Tests.ps1	708-line test suite for helper module functions
scripts/tests/pester.config.ps1	Pester 5.x configuration with code coverage support
scripts/tests/Mocks/GitMocks.psm1	Reusable Git CLI mocking infrastructure for tests
scripts/tests/Fixtures/	16 fixture files for workflow, npm, and security test scenarios
.github/workflows/dependency-pinning-scan.yml	Reusable workflow for SHA pinning validation with SARIF upload
.github/workflows/pester-tests.yml	PowerShell test execution workflow with coverage collection
.github/workflows/main.yml	Integration of new scanning and testing jobs
.github/workflows/pr-validation.yml	PR validation integration for dependency scanning and tests