ci: update OSV Scanner reusable workflow to v2.5.0

[seonghobae]

Purpose

Replace the stale OSV Scanner v2.3.8 reusable-workflow pin with the immutable commit that is exactly tagged upstream as google/osv-scanner-action@v2.5.0.

Exact current scope

Protected base: develop@b88e66e81e9701404d29a0f5de4f58573ceee14f.
Current contributor head: 6550f4f6fa2137471295cd84e242d2e2ae39c936.

One changed file only:

• .github/workflows/osvscanner.yml.

No package manifest, lockfile, Hono, Playwright, product code, scanner suppression, or branch-protection change is included.

Supply-chain provenance

The initial branch pinned f4cfcc01edc9c8b756a9b873b7a623ca674da51e while annotating it as v2.5.0. A fresh upstream provenance audit showed that SHA is a later post-release workflow-maintenance commit, not the commit referenced by the v2.5.0 tag. Leaving that mismatch would make the inline operational evidence false even though the workflow itself remained immutable.

Current head corrects the pin to 8deb546fdb875b9996d27d4950be7312dac076a1, the exact commit referenced by upstream refs/tags/v2.5.0. The tagged reusable PR workflow in turn pins the scanner/reporter actions used by that release to their immutable v2.5.0 revision. The local inline annotation now states only # v2.5.0, matching the actual upstream tag identity.

Existing least-privilege permissions, recursive manifest scanning, non-cancelling source ownership, and the central organization security/review gates remain unchanged.

Verification

The pull-request event must exercise the corrected exact-tag workflow on current head 6550f4f6.... All predecessor-head results are historical because they evaluated the mismatched post-release pin. Merge remains gated on fresh exact-head OSV/repository/security checks, zero valid unresolved findings, qualifying independent approval where required by live policy, and unchanged current head.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b8578dd-f69c-417a-8603-6180c03bb158

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cf78276d-9fc6-4c3d-801c-fd2127e7ccd1

📥 Commits

Reviewing files that changed from the base of the PR and between b88e66e and 10b0754.

📒 Files selected for processing (1)

• .github/workflows/osvscanner.yml

---

📝 Walkthrough

Walkthrough

GitHub Actions의 OSV Scanner 재사용 워크플로 참조를 v2.3.8에서 v2.5.0으로 업데이트했습니다.

Changes

OSV Scanner 업데이트

Layer / File(s)	Summary
워크플로 참조 버전 업데이트 .github/workflows/osvscanner.yml	OSV Scanner 재사용 워크플로 참조를 v2.5.0으로 변경했습니다.

Estimated code review effort: 1 (매우 낮음) | ~2분

Merge Risk: ⚪ Minimal · up to 10b07

This change only updates the OSV Scanner reusable-workflow pin and matching annotation, with existing permissions and scanning behavior unchanged. No actionable merge-blocking risk remains after normal exact-head checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 OSV Scanner 재사용 워크플로를 v2.5.0으로 업데이트하는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/osv-scanner-v2-5-0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent @cwl-noema-review

Review exact current head 10b07540c0024bd906853643a45af2482125d08c against protected develop. Verify the diff is exactly the immutable OSV reusable-workflow pin plus matching v2.5.0 annotation, with no package, lockfile, product, scanner-suppression, credential, or branch-protection change. Publish a formal current-head verdict after exact-head checks are terminal; do not mutate the branch.

[seonghobae]

@opencode-agent review

Please submit an independent formal review for exact current head 10b07540c0024bd906853643a45af2482125d08c. All six repository-native workflows are terminal-success on this exact head. Verify that the one-file OSV reusable-workflow pin resolves the intended upstream v2.5.0 revision, remains immutable, preserves least privilege and recursive scanning, and introduces no unrelated workflow or product change. Do not transfer predecessor-head evidence, mutate the branch, merge, or bypass the required last-push approval rule.

[seonghobae]

@opencode-agent
@cwl-noema-review

[seonghobae]

@opencode-agent

[seonghobae]

@opencode-agent
@cwl-noema-review

Retry independent review for exact current head 10b07540c0024bd906853643a45af2482125d08c against live develop@b88e66e81e9701404d29a0f5de4f58573ceee14f. All six repository-native workflows are terminal-success on this exact head. Verify the one-file change is only the immutable OSV Scanner v2.5.0 reusable-workflow pin and matching annotation, with no credential, suppression, package, product, or protection change. Publish current-head review evidence only; do not mutate or merge.

[seonghobae]

@coderabbitai review

Please review exact current head 10b07540c0024bd906853643a45af2482125d08c. Verify the one-file immutable OSV Scanner reusable-workflow pin and v2.5.0 annotation against current protected develop, with no package/lockfile/product/suppression/credential/governance drift.

[coderabbitai]

@seonghobae I will review pull request #487 at exact head 10b07540c0024bd906853643a45af2482125d08c against develop. I will verify the one-file scope, immutable v2.5.0 pin, matching annotation, preserved workflow security properties, and absence of unrelated changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@opencode-agent
@cwl-noema-review

Request independent review for exact current head 10b07540c0024bd906853643a45af2482125d08c against live develop@b88e66e81e9701404d29a0f5de4f58573ceee14f. All six repository-native workflows are terminal-success and there are no unresolved review threads. Verify the one-file change updates only the immutable OSV Scanner reusable-workflow pin/version annotation, preserves least-privilege and central review/security ownership, and introduces no product/runtime/suppression change. Publish current-head review evidence only; do not mutate or merge.

[seonghobae]

@opencode-agent
@cwl-noema-review

Fresh exact-head review request for 6550f4f6fa2137471295cd84e242d2e2ae39c936 against unchanged protected develop@b88e66e81e9701404d29a0f5de4f58573ceee14f. Scope is one workflow file: replace the stale OSV reusable-workflow pin with immutable upstream google/osv-scanner-action@v2.5.0 tag commit 8deb546fdb875b9996d27d4950be7312dac076a1. All six repository-native workflows, including the exact updated OSV workflow, are terminal-success on this head. Verify current-head provenance and policy only; do not mutate or merge.

[seonghobae]

Closing as technically superseded by #523, not as abandoned work.

Fresh comparison still shows this PR changes only .github/workflows/osvscanner.yml by replacing the reusable-workflow pin with upstream tag commit 8deb546fdb875b9996d27d4950be7312dac076a1. That provenance correction was valuable and has been preserved in #523 at exact head 27b95f435ffd4904e5b98c6940c27aad89a7babe.

#523 uses the direct scanner and reporter action revision carried by upstream v2.5.0 (06b2ab4348248b456ee06c9e953637f55e03504f) while also adding controls this reusable-workflow-only branch cannot provide under ScopeWeave's evidence contract:

• immutable pull-request base and contributor-head checkout;
• runtime SHA verification for both revisions;
• clean: false preservation of old-results.json across the second checkout;
• stable protected-base code-scanning job identity scan; and
• exact-head SARIF publication after differential comparison.

The reusable workflow in this PR delegates candidate selection to event GITHUB_SHA, which is GitHub's synthetic pull-request merge commit, and publishes job identity osv-scan; the latter produced a neutral protected-base configuration-mismatch record rather than passing comparison evidence. Keeping both PRs open would therefore duplicate the v2.5.0 supply-chain intent while retaining the weaker checkout/identity semantics in this branch.

#523's unchanged current head has terminal-success exact-base/exact-head OSV execution on run 31938601743, job 95144333161, including v2.5.0 image pull, both SHA attestations, both scans, comparison, and SARIF upload. Unique valuable work from this PR is thus retained with stronger executable evidence.