feat: [SEC-7263] Add dependency-scan GitHub Actions workflow

[kparkinson-ld]

feat: SEC-7263 Add dependency-scan GitHub Actions workflow

Summary

Adds a new GitHub Actions workflow for dependency scanning to the support-knowledge repository, following the model established in launchdarkly/ld-vsts#64. The workflow uses LaunchDarkly's centralized common-workflows dependency scanning functionality and is configured to run on pull requests and pushes to the main branch.

Key configuration decision: Uses types: 'generic' since this repository contains miscellaneous scripts and tools without a clear package manager (no package.json, go.mod, etc.).

Review & Testing Checklist for Human

• Verify the 'generic' type produces meaningful SBOM results - This repository contains various scripts/tools rather than a traditional codebase, so confirm the dependency scan actually finds and catalogs relevant dependencies
• Test the workflow on a test PR - Create a small test PR to verify the workflow runs successfully and the dependency-scan jobs complete without errors
• Confirm security compliance - Verify this implementation meets the SEC-7263 requirements and integrates properly with LaunchDarkly's security scanning infrastructure

Notes

• This workflow follows the same structure as other LaunchDarkly repositories but uses 'generic' type due to the repository's mixed content structure
• Requested by @kparkinson-ld as part of adding dependency-scan workflows to 18 LaunchDarkly repositories
• Link to Devin run: https://app.devin.ai/sessions/04e1232119fc4dda956196fe0edc593f

---

Related Jira issue: SEC-7263: Investigate impact of compromised NPM packages: debug and chalk

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[professorice]

LGTM

[pkaeding]

For public repos, we can't use this resuable workflow. I will have to check my notes to find the way to do this...

[devin-ai-integration]

Thanks for the feedback @pkaeding! I understand that the current reusable workflow approach isn't suitable for public repositories like support-knowledge.

I'm ready to implement the correct approach for public repos once you find the appropriate method in your notes. Just let me know what changes are needed and I'll update the workflow accordingly.

Should I hold off on any changes until you provide the correct approach for public repositories?

[devin-ai-integration]

Update: I've identified that this issue affects multiple public repositories in the task list:

📋 Public repositories requiring the corrected approach:

• support-knowledge (this PR)
• slack-audiobot
• launchdarkly-contentful-app

📋 Internal repositories (working correctly):

• spinnaker-jobs ✅
• momi ✅

Once you provide the correct approach for public repos, I'll be ready to update all three public repositories with the appropriate dependency-scan workflow configuration. This will ensure consistent implementation across all repository types.

[kparkinson-ld]

For public repos, we can't use this resuable workflow. I will have to check my notes to find the way to do this...

@pkaeding That's because the source repo of the reusable workflow must be public as well right? We have this existing repo https://github.com/launchdarkly/gh-actions with other shared actions/workflows and it is public. Is there any reason not to migrate it there? We could duplicate it temporarily to avoid breaking things for existing configurations.