FED-3006 CI fixes and dependency_validator cleanup

[greglittlefield-wf]

Motivation

While putting up another PR, I noticed a couple issues:

1. The SBOM step failing (example) on one of the matrix runs; it looks like it doesn't like being run more than once
2. dependency_validator failing on imports within test fixture packages

These seemed worth PRing to master separately.

Changes

1. Update SBOM step to only run once
2. Update / clean up dependency_validator config
   • Upgrade to dependency_validator 4.0.0, which doesn't have false positives for package: imports in comments and strings!
   • Add exclude to files within test_fixtures directory
   • Clean up ignores in config no longer needed with 4.0.0 and new exclude
   • Remove old, unused config from pubspec.yaml

Release Notes

Review

See CONTRIBUTING.md for more details on review types (+1 / QA +1 / +10) and code review process.

Please review:

QA Checklist

• Tests were updated and provide good coverage of the changeset and other affected code
• Manual testing was performed if needed
  • Steps from PR author:
    • CI passes
    • SBOM job is step is run exactly once in CI
  • Anything falling under manual testing criteria outlined in CONTRIBUTING.md

Merge Checklist

While we perform many automated checks before auto-merging, some manual checks are needed:

• A Frontend Frameworks Design member has reviewed these changes
• There are no unaddressed comments - this check can be automated if reviewers use the "Request Changes" feature
• For release PRs - Version metadata in Rosie comment is correct

[aviary-wf]

Security Insights

No security relevant content was detected by automated scans.

Action Items

• Review PR for security impact; comment "security review required" if needed or unsure
• Verify aviary.yaml coverage of security relevant code

---

Questions or Comments? Reach out on Slack: #support-infosec.

[sydneyjodon-wk]

Do we even need to keep running CI on 2.18.7?

[greglittlefield-wf]

Good question: I don't think so. I thought about ripping that out, but didn't wanna mess with it right now

[sydneyjodon-wk]

QA +1

• CI passes
• SBOM job is step is run exactly once in CI

[greglittlefield-wf]

@Workiva/release-management-p

[rmconsole-wf]

+1 from RM