security: add supply-chain scanning foundation

[josiahking]

Summary

Adds the EvolvePHP 2 Phase 2.9A supply-chain security foundation for locked dependency auditing, licence-policy enforcement, Dependabot update configuration and CI enforcement.

Changes

• adds Composer lockfile security auditing
• fails on abandoned locked packages
• adds repository-owned locked-dependency licence policy validation
• checks both production and development dependencies
• adds an aggregate supply-chain Composer command
• adds weekly Dependabot configuration for Composer and GitHub Actions
• adds supply-chain enforcement to the existing required Policy (PHP 8.4) CI job
• documents security, licence and network-availability boundaries
• adds supply-chain documentation-policy coverage
• records Phase 2.9A in the changelog

Composer Commands

composer --working-dir=workspace security:audit
composer --working-dir=workspace licenses:check
composer --working-dir=workspace supply-chain

quality remains separate from supply-chain because advisory scanning depends on current external security data.

Security Audit

The committed workspace lockfile currently passes:

composer audit --locked --abandoned=fail

Current result:

No security vulnerability advisories found.

No advisory suppression or abandoned-package bypass is configured.

Licence Policy

Current reviewed engineering allowlist:

• MIT
• BSD-3-Clause
• Apache-2.0

Current locked inventory:

• MIT: 52
• BSD-3-Clause: 31
• Apache-2.0: 1

Apache-2.0 was deliberately reviewed because jetbrains/phpstorm-stubs v2026.1 is currently present in packages-dev.

The licence check:

• covers packages and packages-dev
• fails missing licence metadata
• fails unknown licence identifiers
• fails unreviewed compound expressions
• contains no package-specific exceptions

This is a repository engineering dependency-admission policy, not a general legal compatibility determination.

Dependabot

Adds weekly version-update configuration for:

• Composer in /workspace
• GitHub Actions in /

Internal evolvephp/* path packages are excluded from Composer update PRs.

No credentials, private registries, automatic merge configuration or target-branch override is included.

Repository setting audit confirmed:

• Dependabot vulnerability alerts: enabled
• Dependabot security updates: enabled and not paused

CI

The existing required job identities remain unchanged:

• Policy (PHP 8.4)
• Workspace quality (PHP 8.4)
• Workspace quality (PHP 8.5)

The Policy job now runs:

composer --working-dir=workspace supply-chain

after dependency installation and before the root policy suites.

No GitHub ruleset change is required.

Validation

• supply-chain policy RED: 5 tests, 20 assertions, 5 expected failures
• supply-chain policy GREEN: 5 tests, 96 assertions
• Documentation: 110 tests, 1,214 assertions
• Architecture: 47 tests, 2,941 assertions
• complete root suite: 157 tests, 4,155 assertions
• PHP 8.4 policy suite: 157 tests, 4,155 assertions
• workspace PHPUnit: 6 tests, 18 assertions
• Deptrac: 0 violations
• PHPStan: no errors
• PHP-CS-Fixer: 0 files fixable
• Composer strict/check-lock validation passed
• security audit passed
• licence check passed
• aggregate supply-chain passed
• aggregate workspace quality passed
• negative licence fixtures passed
• Dependabot YAML validation passed
• git diff --check passed

Scope

Exactly seven files:

• .github/dependabot.yml
• .github/workflows/quality.yml
• CHANGELOG.md
• tests/Documentation/EvolvePhp2SupplyChainSecurityTest.php
• workspace/README.md
• workspace/composer.json
• workspace/tools/check-licenses.php

No dependency versions, Composer lockfiles, package manifests, runtime files, RFCs or GitHub repository settings are changed.