feat: add Dependency Firewall package evaluation endpoint

Michael Eddingtonrequested to merge
feat/dependency-firewall-evaluate into main

What does this MR do?

Adds a SecurityDependencyFirewall service with a single method, EvaluatePackage, that evaluates one package coordinate against a project's Dependency Firewall policies:

eval, _, err := client.SecurityDependencyFirewall.EvaluatePackage(projectID, &gitlab.EvaluatePackageOptions{
    Ecosystem: gitlab.Ptr("npm"),
    Name:      gitlab.Ptr("left-pad"),
    Version:   gitlab.Ptr("1.3.0"),
})
// eval.Outcome is one of "allowed", "warned", "blocked"; eval.Reason explains a non-allow outcome.

POST projects/:id/dependency_firewall/evaluate, request body {ecosystem, name, version}, response {outcome, reason}.

Caveat: endpoint is experimental / not yet in public API docs

This should not be merged until maintainers decide it is appropriate. The backing endpoint is currently:

  • served only behind the dependency_firewall_phase1 feature flag (disabled by default),
  • marked hidden true with lifecycle :experiment, and
  • deliberately excluded from the OpenAPI spec, with an inline comment on the Rails side stating the contract may change without notice and that no client should be generated against it.

CONTRIBUTING.md notes this project supports "what is in the public GitLab API docs." This endpoint is not there yet, so this MR is opened as a Draft for guidance: accept now to unblock downstream (glab) work, or defer until the endpoint graduates.

Author checklist

  • Service + options + entity follow the existing service pattern (do[...], ProjectID{pid}, RequestOptionFunc).
  • Unit tests added (security_dependency_firewall_test.go), int64 and string project IDs.
  • Generated mocks / testing client / service map regenerated via make generate.
  • make reviewable (fmt + lint + race tests) passes locally.

Merge request reports