[promisepreston]

Change

Add one read-only public scanner caller and its coverage note. The caller pins the accepted organization helper f83277823665d59b2a31cab6824bedf4f162cfdd, whose two scanner jobs always use GitHub-hosted Ubuntu. It receives no inputs, secrets or self-hosted access. Existing application verification and deployment workflow bytes are unchanged.

Verification

• actionlint on the new workflow: passed.
• git diff --check: passed.
• Published helper tree and workflow blob exactly match the reviewed successor; helper main engine qualification passed upstream.
• Candidate scanner engines and existing Preview CI: pending this PR. No local application test or build ran on the owner's Mac.

Limits and integration boundary

Current-content GitLeaks and high/critical Trivy coverage exclude historical and unfixed-vulnerability completeness. Findings require actual triage; no suppressions, paid scan configuration, branch protection or provider changes are included.

This is a source candidate, not deployment authority. A merge to main also triggers the existing protected Preview Pages deployment. Preserve that boundary before integration. No website content, release manifest, download artifact or application source changes are included.

Summary by CodeRabbit

• New Features
  • Automated security scans now run on pull requests and updates to the main branch, with manual runs available. Metadata-only pull request edits are skipped unless the target branch changes. Existing branch checks remain unchanged.
• Documentation
  • Added details on scan coverage, exclusions, handling of findings, and reports. Deployment to Pages continues after changes are integrated into the main branch.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1394992b-9958-4167-8993-64e1e5431887

📥 Commits

Reviewing files that changed from the base of the PR and between 0b7bb29 and fdc44b1.

📒 Files selected for processing: 2

• .github/SCANNER-COVERAGE.md
• .github/workflows/ci-security.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Adds a GitHub Actions workflow for public-source security checks and documentation describing scanner coverage, report handling, failure conditions, and integration behavior.

Changes: Public-source security scanning

Layer / File(s)	Summary
Security workflow and coverage .github/workflows/ci-security.yml, .github/SCANNER-COVERAGE.md	The workflow runs for pull requests, pushes to main, and manual dispatch. It uses read-only contents permissions, cancels in-progress runs for the same ref, and skips edited pull requests when the base ref did not change. The documentation describes scanner scope, report handling, failure conditions, triage, branch checks, and deployment behavior.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to fdc44

The new security scans have no identified merge-blocking issue. Candidate CI execution remains pending but does not establish a defect.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding hosted public-source security scans to CI.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud