fix(security): repair OSV output contract and stale gate assertions

[seonghobae]

Scope

Repairs the central OSV output-file contract and the stale Strix quick-gate assertions that prevented exact-head policy from evaluating the current scheduler contract.

Changes

• Replace deprecated OSV v2.3.8 --output arguments with supported --output-file arguments in .github/workflows/security-scan.yml.
• Update the required workflow contract test.
• Align scripts/ci/test_strix_quick_gate.sh with the current repository-scoped repository_dispatch concurrency contract and metadata-free workflow-run cancellation contract.

Evidence

• Historical GRC exact-head Security Scan run 32506592698 / job 96848034820: OSV exited 0 but the deprecated flag left the required result files absent.
• Official OSV usage documents --output-file: https://google.github.io/osv-scanner/usage/
• Local targeted contract test: 52 passed.
• bash -n scripts/ci/test_strix_quick_gate.sh passed.
• git diff --check passed.
• The long-form Strix fixture run was interrupted during timeout-cleanup and is not reported as passed.
• This PR supersedes orphaned PR fix(security): use supported OSV output-file flag #1207, whose GitHub PR ref remains pinned to the predecessor head.

No checks are suppressed, no workflow is disabled, and no protected-branch bypass is requested.

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 181fd761-8f68-4baa-9ce5-aeb1198f9a97

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[seonghobae]

Maintainer verification — exact head 518219fd9d6d81481b96b5ceaaff7ebbc7e69aed

• Reproduced the predecessor fix(security): use supported OSV output-file flag #1207 failure: OSV Scanner exited successfully but the deprecated --output flag did not produce old-results.json/new-results.json; this is a real workflow contract failure, not a flaky source test.
• fix(security): repair OSV output contract and stale gate assertions #1208 carries the supported --output-file repair and aligns the stale scheduler contract assertions with current repository-scoped dispatch and metadata-free workflow-run concurrency.
• Added only the two missing 100% docstring-gate entries exposed by exact local verification (GitHubClient.__init__ and the deterministic FakeClient.__init__).
• Exact base: 6a79f075d62b5f8dcfef6145960f1c42c147f273; no force push or protected-branch write.
• Local exact-tree verification: 1293 passed, 16 subtests passed; statement/branch coverage 100%; interrogate 100%; targeted actionlint, shell syntax, compileall, CodeGraph sync/status, and git diff --check passed.

Hosted checks have restarted for this exact head and are queued. Independent approval is still absent; merge remains on the normal protected path.

[seonghobae]

@opencode-agent @cwl-noema-review Please review exact head 518219fd9d6d81481b96b5ceaaff7ebbc7e69aed. Focus on the OSV v2.3.8 output-file contract, fail-closed artifact checks, and the scheduler quick-gate assertion alignment. Do not approve any superseded head.

[seonghobae]

Exact-head verification

• PR: fix(security): repair OSV output contract and stale gate assertions #1208
• Exact head: 9f0845517010f2c4695de83dd2bd50385c068a15
• Exact base: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39
• Local merge-result tree: 11e0865d6aa0c24cfb6d30d84b46d44549bbd6ad
• Scope: OSV scanner/reporter output-file contract, scheduler gate assertions, and exact main restack.
• Local exact-head verification: 1308 passed, 16 subtests passed; statement/branch coverage 100% (8128/8128, 3144/3144); interrogate 100%; Security Scan actionlint, compileall, and git diff --check passed.
• Current hosted Checks are still completing; no predecessor evidence is reused.
• Review-only dispatch requested for this exact head. Do not merge, dismiss, bypass, update the branch, or reuse superseded approval.

[seonghobae]

@opencode-agent @cwl-noema-review Please review exact head de2ea4b9d7c8bcca81a69834d6d1859bfd9425ed. Scanner steps use the OSV v2 --output-file contract; the pinned v2.3.8 reporter uses its distinct official --output-files=sarif:results.sarif contract (google/osv-scanner v2.3.8 docs/osv-reporter.md). Fail-closed result-file assertions remain. Do not approve superseded heads.

[seonghobae]

Current-head audit

• Exact head: de2ea4b9d7c8bcca81a69834d6d1859bfd9425ed
• Exact base: 6a79f075d62b5f8dcfef6145960f1c42c147f273
• Diff is bounded to the OSV scanner/reporter output-file contract, its gate assertions, one fixture docstring, and traceability.
• Review threads: 0 unresolved; no qualifying approval is currently recorded.
• Local exact-head verification: 86 focused tests passed; security-scan actionlint, compileall, interrogate 100%, and diff check passed.
• Hosted checks are queued; no current source failure is evidenced.
• Decision: WAIT_AND_REMEDIATE; normal squash auto-merge remains enabled; no force merge.

[seonghobae]

Current-head verification update

• Exact head: 9f0845517010f2c4695de83dd2bd50385c068a15
• Exact base: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39
• Normal restack onto current main is present; predecessor evidence is discarded.
• Review threads: 0 unresolved; no qualifying approval is currently recorded.
• Local exact-head verification: 86 focused tests passed; security-scan actionlint, compileall, interrogate 100%, and diff check passed.
• Hosted required Checks are queued; no current source failure is evidenced.
• Decision: WAIT_AND_REMEDIATE; normal squash auto-merge remains enabled; no force merge.

[seonghobae]

Exact-head verification update

• Exact head: 9f0845517010f2c4695de83dd2bd50385c068a15
• Exact base: fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39
• Local merge-result tree: 9196a75fb362652e722fad3fc01e011c5b7c735c (base is an ancestor; tree equals current head)
• Full local verification: 1308 passed, 16 subtests; statement/branch coverage 8128/3144, 100%; interrogate 100%; compileall, changed-workflow actionlint, shell syntax, and git diff --check passed.
• Dependency audit: exact hash lock still contains pip==26.1.2; pip-audit reproduces PYSEC-2026-3721 with fix 26.2, so this is a real inherited dependency finding owned by root fix(security): repair pip audit and schedule orchestrator review #1198, not a force-merge deadlock.
• Hosted exact-head observation: 16 success, 11 pending, 14 skipped, 1 neutral; no failure conclusion and no qualifying formal approval.

Decision: WAIT_AND_REMEDIATE. Keep normal auto-merge enabled; re-run after the root dependency repair is normally integrated and required Checks/approvals are available. No bypass, force push, direct protected-branch push, fake status, or self-approval.

[seonghobae]

Closing this competing writer after absorbing each causal change into its existing canonical owner branch.

• OSV v2.3.8 output contract: fix(osv): preserve immutable direct-source provenance #1158 now uses --output-file for all four scanner invocations and --output-files=sarif:results.sarif for the reporter while preserving its authoritative-result classifier and provenance boundary. RED exact head 10f1ccd811e4971ce1b505513b43df3650080fa3 failed exactly two assertions (2 failed, 1316 passed, 69 subtests). GREEN run https://github.com/ContextualWisdomLab/.github/actions/runs/32513845241 checked out db6dee6d6d93e1ef4a4508208e0833c9d4d0c478 and passed 1318 tests, 69 subtests; reconciler coverage remained 289 statements / 98 branches at 100%. Current fix(osv): preserve immutable direct-source provenance #1158 head c24ce16ab72c5b372d2c397f0af8f84dc1b63d2f is that repair plus protected-main Storybook integration only; its new hosted evidence remains non-passing until terminal.
• Scheduler/Strix assertion drift: fix(strix): fail closed on incomplete provider scans #1153 current head 1f8878d78cb2f0aed68964ea5fabf5679526e78b already requires repository-scoped repository_dispatch, rejects run-id grouping, and requires metadata-free workflow-run cancellation.

The docstring-only coordinator edits here are unrelated to either causal defect. No gate is weakened and no evidence from this PR is counted as passing.

[seonghobae]

Exact-head failure classification

• Exact head: 9f08455
• Hosted pip-audit failed on requirements-pip-audit-ci-hashes.txt because pip 26.1.2 is affected by PYSEC-2026-3721; the log reports fix version 26.2.
• This is a real dependency-gate failure, not an infrastructure-only failure and not evidence for bypass. The lock repair is owned by the normal fix(security): repair pip audit and schedule orchestrator review #1198/fix(actions): deduplicate workflow-run scheduler scans #1203 dependency stack.
• Revalidate this PR only after the canonical lock owner is normally integrated or this branch is normally restacked onto that exact protected base.

Decision: WAIT_AND_REMEDIATE; no force merge, status fabrication, or failure suppression.