## Summary When an MR changes `composer.json` (root or sub-module), add the `needs-dependency-review` label and post a comment pinging marcus and artem. ## Work Track Cross-track (AI Core / coordination) ## Context / Background Dependency changes need an extra eye for license / supply chain reasons. Detect any `composer.json` change in MR diffs and route it to the dependency reviewers automatically. Parent / related: #3586474. This issue is blocked by the three exploration issues (#3586475, #3586476, #3586477) — the platform choice and the available `gitlab_api` primitives must land first. ## Tasks * [ ] Subscribe to `Merge Request Hook` events (open + update). * [ ] Inspect the diff: if any `composer.json` (root or sub-module) is added / modified, set `needs-dependency-review` on the MR (and on the linked issue). * [ ] Post a single comment pinging marcus and artem (replace with their drupal.org / GitLab usernames during implementation) explaining what changed. * [ ] Edit (do not re-post) the comment on subsequent updates. * [ ] When all `composer.json` changes are reverted, remove the label. ## Acceptance Criteria * [ ] An MR that touches `composer.json` is labelled and the reviewers are pinged exactly once. * [ ] Reverted changes clear the label. * [ ] No duplicate ping comments. ## Related issues ## AI Usage - [x] AI Assisted Issue — This issue was generated with AI assistance, but was reviewed and refined by the creator.