Fix OSSAR workflow: restore valid YAML, add MSDO integration, drop pull_request trigger

[Copilot]

The OSSAR workflow was missing its jobs: block entirely (rendering it invalid YAML that would never run), lacked the Microsoft Security DevOps CLI step despite the PR description claiming otherwise, and included a pull_request trigger that causes SARIF upload failures on fork PRs due to read-only GITHUB_TOKEN.

Changes

• Fix YAML structure — added jobs: OSSAR-Scan: with runs-on: windows-latest; moved env: to job scope; properly indented all steps
• Add MSDO integration — introduces microsoft/security-devops-action@08976cb6 (v1.12.0) with continue-on-error: true and a dedicated conditional SARIF upload step
• Remove pull_request trigger — SARIF upload via upload-sarif requires security-events: write, which is unavailable on fork PR contexts; workflow now triggers on push to master and weekly schedule only
• Add security-events: write permission — explicitly granted at workflow level, required for upload-sarif
• Pin all action SHAs — actions/checkout, github/ossar-action, microsoft/security-devops-action, and github/codeql-action/upload-sarif all pinned to full commit SHAs

- name: Run Microsoft Security DevOps
  uses: microsoft/security-devops-action@08976cb623803b1b36d7112d4ff9f59eae704de0 # v1.12.0
  id: msdo
  continue-on-error: true

- name: Upload MSDO results
  uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3
  with:
    sarif_file: ${{ steps.msdo.outputs.sarifFile }}
  if: steps.msdo.outputs.sarifFile

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[JMG3000]

Review

All changes have been reviewed and approved based on the risk assessed.

Status:

Approved

[Copilot]

Pull request overview

Repairs the broken OSSAR GitHub Actions workflow so code scanning can run successfully again on trusted contexts (push + schedule), and adds Microsoft Security DevOps (MSDO) scanning with SARIF upload.

Changes:

• Restores valid workflow structure by adding the missing jobs: block and placing env: / steps: at the correct scope.
• Adds MSDO scanning and uploads its SARIF results when produced.
• Removes the pull_request trigger and grants security-events: write; pins all referenced actions to commit SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.