feat: SOC2 vendor inventory with CI checks

[emmyoat]

Overview

Adds a lightweight, in-repo SOC2 vendor-management inventory with periodic risk review dates and CI enforcement, per issue #521.

• Registry: docs/security/vendors.yaml — YAML entries with risk score, criticality, owner, invoicing currency, and review_date.
• Schema: docs/security/vendor-registry.schema.json — documents the exact entry shape.
• Checker: scripts/vendor-inventory-check.ts — dependency-free validator + freshness checker (no new npm packages).
• CI: .github/workflows/vendor-inventory.yml — runs on PRs touching the registry, fails if any entry is older than 12 months, and posts a summary comment (vendor count, per-vendor next review date, errors/warnings) on the PR.

Related Issue

Closes #521

Changes

• docs/security/vendors.yaml — registry with 4 vendors (cloud, payments, email) and allowed currencies.
• docs/security/vendor-registry.schema.json — JSON Schema (schema_version 1) with required fields, risk_score 1–5, criticality enum, currency ISO-4217, review_date format.
• docs/security/vendor-inventory.md — guide: how to add/update vendors, review cadence, CI behavior, edge cases.
• scripts/vendor-inventory-check.ts — includes a small, strict YAML-subset parser (block maps/sequences/scalars, comments, quoted scalars) so no YAML dependency is introduced. Checks:
  • schema validation (missing risk_score, out-of-range values, malformed/future dates, invalid criticality, currency not allowed),
  • duplicate vendor id detection,
  • freshness: any review_date older than 12 months fails; entries within 3 months of the limit produce warnings,
  • currency change: when a vendor's currency changes vs. the PR base branch without an updated review_date, the check fails (change requires re-review),
  • posts the summary as a PR comment when GITHUB_TOKEN/PR_NUMBER/GITHUB_REPOSITORY are present (mirrors scripts/dep-alerter.js).
• .github/workflows/vendor-inventory.yml — node 24, npm ci, npx tsx scripts/vendor-inventory-check.ts, full checkout depth so the base registry can be diffed.
• scripts/__tests__/vendor-inventory-check.test.ts — 27 tests covering parser, registry parsing, validation, freshness (fresh/warning/stale), currency-change edge cases, and end-to-end runCheck.

Verification Results

• npm test -- --testPathPattern=vendor-inventory-check → 27 passed, 0 failed.
• npx tsx scripts/vendor-inventory-check.ts (real registry) → exit 0, "Vendor inventory OK."
• npx eslint on new files → clean. Prettier → clean.
• Full npm test: pre-existing failures in several src/ suites (e.g. src/utils/__tests__/redact.test.ts, src/routes/__tests__/admin.gdprDsr.test.ts) — reproduced identically on clean upstream/main (89 failed / 10 passed for those suites with this PR's changes stashed). They appear to be local-environment issues (Node v25 vs CI Node 24) and are unrelated to this PR, which only adds new files and touches no existing source.

Acceptance Criteria

Criterion	Status
Vendor YAML registry with schema	Done (vendors.yaml + vendor-registry.schema.json)
CI fails if any entry is older than 12 months	Done (freshness check + workflow)
Summary emitted in PR comment on change	Done (posts on registry-touching PRs)
Edge case: missing risk score	Covered (test + validation error)
Edge case: duplicate vendor entry	Covered (test + validation error)
Edge case: currency change	Covered (re-review required; test + check)
Tests (npm test)	27 new tests pass; pre-existing suite failures reproduced on clean main
Documentation	docs/security/vendor-inventory.md

[drips-wave]

@emmyoat Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits