ci(security): SHA-pin reusable security-scan workflow

[WomB0ComB0]

Summary

The security workflow invoked resq-software/.github's reusable security-scan.yml through the mutable @main ref. Pinning it to a full-length commit SHA:

• Clears the open zizmor unpinned-uses code-scanning alert (security.yml:24, severity error — alert chore(deps): bump the rust-minor-patch group with 3 updates #10).
• Is the most likely cause of the scheduled-run startup_failure seen weekly since 2026-04-27 (the org enforces "actions must be pinned to a SHA"). Those scheduled runs reported startup_failure with 0 jobs executed, consistent with workflow-resolution/policy rejection at startup.

Pinned to ee2001974be1e5610cff3a2c669cfab95c7415e7 — current .github main HEAD and the last commit to touch security-scan.yml (2026-05-04, resq-software/.github#20). Matches the SHA-pin convention already used by ci.yml. Trailing # main (...) comment keeps Dependabot able to propose updates.

On secrets: inherit

Retained and documented inline. The reusable workflow reads org-level secrets (SEMGREP_APP_TOKEN) that are not declared in its workflow_call.secrets: block, so they cannot be forwarded explicitly. Fully clearing the zizmor secrets-inherit warning (alert #11, warning) requires an org-side secrets: declaration in security-scan.yml first — out of scope here.

Test plan

• CI green on this PR.
• After merge, trigger security via workflow_dispatch on main; confirm no startup_failure.
• Confirm code-scanning alert chore(deps): bump the rust-minor-patch group with 3 updates #10 (unpinned-uses) auto-resolves.
• Next scheduled run (Mondays, cron 17 6 * * 1) completes.

Out of scope

• The separate scan / osv-scanner failures on stale branches (they're behind main, which already carries the per-lockfile osv-scanner config).
• The secrets-inherit warning (needs the org-side change above).

Summary by CodeRabbit

• Chores
  • Updated security workflow configuration to use pinned references for improved stability and security.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b358de36-e0ea-4c43-938c-94fd4fcdde2f

📥 Commits

Reviewing files that changed from the base of the PR and between 2ce6f0e and 78faf58.

📒 Files selected for processing (1)

• .github/workflows/security.yml

---

📝 Walkthrough

Walkthrough

The PR updates the security workflow job to pin its reusable workflow reference to a specific commit SHA instead of the mutable @main branch, hardening against unexpected changes. Comments explain the org policy and Dependabot's update mechanism.

Changes

Workflow reference pinning

Layer / File(s)	Summary
Security workflow SHA pinning .github/workflows/security.yml	Reusable workflow reference pinned from @main to commit SHA ee2001974be1e5610cff3a2c669cfab95c7415e7, with comments documenting the org security policy and Dependabot update behavior. Existing inputs and secrets inheritance preserved.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

A rabbit pins its workflow tight,
No mutable @main in flight,
The SHA holds fast and true,
Security locked down for you! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title 'ci(security): SHA-pin reusable security-scan workflow' directly and accurately summarizes the main change: pinning the security workflow reference from @main to a specific SHA commit.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/pin-security-scan-sha

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}