fix(security): use supported OSV output-file flag

[seonghobae]

Summary

• Replace deprecated OSV v2.3.8 --output arguments with supported --output-file arguments for base, head, retry, and SARIF reporter outputs.
• Add a regression contract that rejects the deprecated result-file flags.
• Record the required-check output contract repair in CHANGELOG.md.

Exact evidence

• Base: 6a79f075d62b5f8dcfef6145960f1c42c147f273 (ContextualWisdomLab/.github@main)
• Head: 8871786f
• Historical failure: ContextualWisdomLab/governance-risk-compliance#51 predecessor Security Scan run 32501950554, job 96833448601, failed at Require OSV scan output after both scanner invocations exited 0 without creating the requested files. The runner log emitted the OSV v2.3.8 deprecation warning for --output.
• Verification: uv run --no-project --with pytest pytest -q tests/test_required_workflow_queue_contract.py (52 passed); actionlint .github/workflows/security-scan.yml; git diff --check.

The existing central provenance repair ContextualWisdomLab/.github#1158 touches the same workflow. This PR intentionally remains the smallest independently reviewable CLI-compatibility repair; reconcile the branches normally before merge. No required workflow is disabled and no scanner finding is suppressed.

---

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 98273cdb-d6d6-4926-95ab-9e5f1b6984db

📥 Commits

Reviewing files that changed from the base of the PR and between 6a79f07 and 8871786.

📒 Files selected for processing (3)

• .github/workflows/security-scan.yml
• CHANGELOG.md
• tests/test_required_workflow_queue_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 OSV flag rename hinges on unverified upstream support

The rename of --output= to --output-file= at all five OSV sites in security-scan.yml (84, 102, 123, 141, 194) is correct only if v2.3.8 accepts --output-file. No repo evidence confirms the flag name; it rests on the author's cited failed run. If the flag is unsupported, Require OSV scan output fails the required gate for every consuming repo. Confirm against upstream v2.3.8.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Canonical successor disposition

This PR's exact OSV --output-file correction is already included in the current stack-root #1198 at head de56b8f817f1f8b46986aa16232643cf3bc34933, together with the pip-audit security repair and contextual-orchestrator caller. The current #1198 head includes the matching contract-test updates, so this standalone PR is a duplicate and will be closed as superseded.

[seonghobae]

Closed as superseded by the canonical stack-root #1198.

[seonghobae]

Exact-head review disposition

• PR API exact head remains 8871786f95cec1a02234d921453343d14b14f40c; base remains 6a79f075d62b5f8dcfef6145960f1c42c147f273.
• Devin's --output-file concern is resolved by upstream evidence: OSV-Scanner's official usage documentation specifies osv-scanner scan ... --output-file, and the official v2.3.8 release is the pinned release used here: https://google.github.io/osv-scanner/usage/ and https://github.com/google/osv-scanner/releases/tag/v2.3.8
• Hosted exact-head-path-policy failed on two stale assertions in scripts/ci/test_strix_quick_gate.sh: it required the retired github.run_id dispatch group and an obsolete exact concurrency expression, while tests/test_required_workflow_queue_contract.py already requires the current repository-scoped dispatch contract.
• I repaired only those two assertions and pushed normal follow-up commit 648b601adfc410a1f1af2da5db6aec48663733f3 to the PR head branch. GitHub's PR ref still reports 8871786, so no validation result from 648b601 is being claimed until the exact PR head synchronizes.
• Local evidence for the repair: 52 required-workflow contract tests, shell syntax, and git diff --check passed. The long-form Strix fixture run was interrupted during a timeout-cleanup fixture and is not reported as passed.
• Decision remains WAIT_AND_REMEDIATE; no approval, bypass, force-push, or merge.

[seonghobae]

Superseded by PR #1208

The branch fix/osv-output-file-20260822 advanced normally to 648b601adfc410a1f1af2da5db6aec48663733f3, but this PR's GitHub head ref remained pinned to predecessor 8871786f95cec1a02234d921453343d14b14f40c. The current branch has no open-PR association for #1207.

To preserve exact-head evidence, PR #1208 was created from the current branch: #1208

This PR is being closed as an orphaned stale-head record; its review and hosted failure history remain preserved. No protected-branch bypass or force push was used.