ci: add ORT (OSS Review Toolkit) workflow suite

[Copilot]

No ORT integration existed; the repo had no SBOM generation, license compliance checks, or OSV-backed dependency advisory beyond pip-audit.

Changes

• .github/workflows/ort.yml — new workflow running the full ORT pipeline:
  • Analyzer — dependency graph from requirements.txt (pip/PyPI)
  • Advisor — OSV CVE lookups across all resolved dependencies
  • Reporter — CycloneDX (JSON + XML), SPDX (JSON + YAML), and WebApp SBOM artifacts

Key decisions

Setting	Value	Reason
allow-dynamic-versions	true	requirements.txt uses unpinned specifiers
fail-on	''	Informational until a violation baseline is set
evaluator	omitted	Requires authored policy rules in an ORT config repo
action SHA	62e59b4b	No stable releases published upstream

Follows existing workflow conventions: pinned SHAs, permissions: {} reset with least-privilege grants, Sunday 01:00 UTC schedule (no overlap with existing Saturday scans).

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

Adds an ORT (OSS Review Toolkit) GitHub Actions workflow to analyze Python dependencies, query OSV advisories, and generate SBOM artifacts for supply-chain visibility.

Changes:

• Introduces a scheduled + PR/push-triggered ORT pipeline (analyzer/advisor/reporter) using oss-review-toolkit/ort-ci-github-action.
• Generates SBOM outputs (CycloneDX, SPDX, WebApp) and uploads ORT results as workflow artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

actions/upload-artifact does not reliably expand ~ (tilde) in path, so this may end up looking for a literal ~/.ort/ort-results/ directory and upload nothing (only warning due to if-no-files-found: warn). Prefer copying the ORT results into the workspace and uploading a relative path, or use a GitHub expression that resolves to an absolute path (not shell expansion).

Suggested change

	path: ~/.ort/ort-results/
	path: ${{ env.HOME }}/.ort/ort-results/

[codacy-production]

Codacy's Analysis Summary

0 new issue (≤ 0 issue)
0 new security issue
More details

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes. Give us feedback}

[codacy-production]

Pull Request Overview

The ORT workflow is correctly implemented and follows security best practices like SHA pinning and job-level permission resets. The tool configuration is appropriately set to informational for its initial rollout. The only recommendation is to refine the workflow permissions to remove an unused grant.

Test suggestions

• Verify that the workflow generates valid CycloneDX and SPDX SBOM artifacts within the ort-results artifact after a successful run
• Verify that the Advisor identifies vulnerabilities by temporarily adding a known-vulnerable package (e.g., requests==2.6.0) to requirements.txt and checking the ORT results

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the workflow generates valid CycloneDX and SPDX SBOM artifacts within the `ort-results` artifact after a successful run
2. Verify that the Advisor identifies vulnerabilities by temporarily adding a known-vulnerable package (e.g., `requests==2.6.0`) to `requirements.txt` and checking the ORT results

---

🗒️ Improve review quality by adding custom instructions

[codacy-production]

_{⚪ LOW RISK}

The security-events: write permission is currently unused as the workflow is not configured to generate or upload SARIF reports. To maintain a least-privilege baseline, this permission should be removed.

This might be a simple fix:

Suggested change

	permissions:
	contents: read
	security-events: write
	permissions:
	contents: read