Make dependency review one repo-wide gate, not a per-SDK one (#73061)

`dependency-review-action` has no path or manifest input. Once it runs
it reviews the entire dependency graph diff of the PR, every lockfile
included - so a gate named after one SDK can only ever be lying about
what it covers.

That is not theoretical. apache/airflow#72946, a release sync PR that
changed 816 files and not one of them under `java-sdk/`, tripped the
Java SDK gate through the self-reference in its own `paths` filter
(v*-test and v*-stable keep different copies of every workflow file),
and the Java SDK gate then failed on a Python advisory in `uv.lock`.

Replace the two per-SDK review jobs with one `Dependency review`
workflow covering the manifests of every ecosystem in the repo:

* new `.github/workflows/dependency-review.yml`, triggered by any
  Python, JavaScript, Go or JVM manifest in the PR.
* `java-sdk-dependency-security.yml` keeps only the Gradle
  `dependency-submission` job, which really is Java-specific, and
  drops its `pull_request` trigger.
* `ts-sdk-dependency-review.yml` goes away - the generic gate already
  reviews `ts-sdk/package.json` and `ts-sdk/pnpm-lock.yaml`.

The check name contributors see, `Reject vulnerable dependency
changes`, is unchanged. The settings are the stricter of the two the
repo had: the ts-sdk gate ran at the action's default
`fail-on-scopes: runtime`, and now gets `runtime, development,
unknown` like the java one.

Generated-by: Claude Opus 5
Claude-Session: https://claude.ai/code/session_01G9A6Mofr5qErDuTh7vqWcX

.github/workflows/dependency-review.yml

@@ -0,0 +1,82 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+---
+name: Dependency review
+
+# `dependency-review-action` has no way to limit itself to one ecosystem's
+# manifests: once it runs it reviews the whole dependency graph diff of the PR,
+# every lockfile included. So this is one repo-wide gate rather than a per-SDK
+# one - a per-SDK gate would only be lying about what it covers, and would fail
+# on another ecosystem's advisory under a name that points at the wrong team.
+#
+# Keep the `paths` list below in step with the manifests the repo actually has:
+# a dependency file that is not listed here is never reviewed.
+
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+    paths:
+      # Python
+      - "uv.lock"
+      - "**/uv.lock"
+      - "pyproject.toml"
+      - "**/pyproject.toml"
+      - "**/requirements*.txt"
+      # JavaScript / TypeScript
+      - "**/package.json"
+      - "**/pnpm-lock.yaml"
+      - "**/package-lock.json"
+      - "**/yarn.lock"
+      # Go
+      - "**/go.mod"
+      - "**/go.sum"
+      # Java / Kotlin / Scala
+      - "**/*.gradle"
+      - "**/*.gradle.kts"
+      - "**/gradle/libs.versions.toml"
+      - "**/gradle.lockfile"
+      - "**/pom.xml"
+      # This workflow
+      - ".github/workflows/dependency-review.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Reject vulnerable dependency changes
+    runs-on: ubuntu-slim
+    steps:
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime, development, unknown
+          show-openssf-scorecard: true
+          show-patched-versions: true
+          # GHSA-8mgp-746c-j5xp / CVE-2026-81726 - path traversal in nltk's
+          # model-artifact save/load APIs, no released fix yet. nltk is a CI-only
+          # transitive dependency (llama-index-core, pulled by the common.ai
+          # provider's "llamaindex" extra); it is not in the released constraints
+          # and none of the affected APIs are reachable from llama-index-core,
+          # which only uses the Punkt tokenizer and the stopwords corpus. The fix
+          # is merged on nltk's develop branch (nltk/nltk#3757, #3759, #3813) and
+          # is waiting on a 3.10.4 release - drop this entry once that ships.
+          allow-ghsas: GHSA-8mgp-746c-j5xp

.github/workflows/java-sdk-dependency-security.yml

@@ -18,10 +18,6 @@
 name: Java SDK dependency security
 
 on:  # yamllint disable-line rule:truthy
-  pull_request:
-    paths:
-      - "java-sdk/**"
-      - ".github/workflows/java-sdk-dependency-security.yml"
   push:
     branches:
       - main
@@ -36,25 +32,11 @@ permissions:
 
 concurrency:
   group: java-sdk-dependency-security-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: false
 
 jobs:
-  dependency-review:
-    name: Reject vulnerable dependency changes
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-slim
-    steps:
-      - name: Review dependency changes
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
-        with:
-          fail-on-severity: high
-          fail-on-scopes: runtime, development, unknown
-          show-openssf-scorecard: true
-          show-patched-versions: true
-
   dependency-submission:
     name: Submit resolved Gradle dependencies
-    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     permissions:
       contents: write

.github/workflows/ts-sdk-dependency-review.yml

@@ -1,44 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
----
-name: TypeScript SDK dependency review
-
-on:  # yamllint disable-line rule:truthy
-  pull_request:
-    branches:
-      - main
-    paths:
-      - "ts-sdk/package.json"
-      - "ts-sdk/pnpm-lock.yaml"
-      - ".github/workflows/ts-sdk-dependency-review.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ts-sdk-dependency-review-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  dependency-review:
-    name: Reject vulnerable dependency changes
-    runs-on: ubuntu-slim
-    steps:
-      - name: Review dependency changes
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
-        with:
-          fail-on-severity: high