Summary

Create a set of composable GitHub Actions workflows under .github/workflows/ that fetch code scanning alerts weekly and create one backlog issue per unique rule title for new findings, updating existing issues when a match is found.

Motivation

Manual security backlog creation doesn't scale. A weekly workflow automates discovery of new code scanning findings and creates actionable GitHub issues without duplicating existing ones.

Acceptance Criteria

• scripts/security/Get-CodeScanningAlerts.ps1 exists (completed in feat(skills): add github-security code-scanning skill #1418):
  • Parameters: Owner (mandatory), Repo (mandatory), Branch (default: main), OutputFormat (Table | Json | Markdown)
  • Pagination loop fetching 100 alerts per page until exhausted
  • Output grouped by rule.description, sorted descending by count
  • Follows hve-core PowerShell conventions: shebang, #Requires -Version 7.0, [CmdletBinding()], $ErrorActionPreference = 'Stop', SecurityHelpers.psm1 import via Join-Path $PSScriptRoot
• scripts/tests/security/Get-CodeScanningAlerts.Tests.ps1 exists (completed in feat(skills): add github-security code-scanning skill #1418)
• Three composable workflows created under .github/workflows/: gh-code-scanning.yml (scan and artifact upload), create-gh-code-scanning-issues.yml (issue creation/update), and weekly-gh-code-scanning.yml (schedule orchestrator), with:
  • Schedule: cron: '0 3 * * 1' (Mondays 03:00 UTC, offset from existing Monday 09:00 job)
  • workflow_dispatch trigger on the orchestrator
  • Permissions: contents: read, issues: write, security-events: read (scoped per workflow)
  • All action refs pinned to SHA
  • Step 1 (pwsh): calls Get-CodeScanningAlerts.ps1 -OutputFormat Json, writes alerts.json
  • Step 2 (bash): loops jq -c '.[]' alerts.json, checks for existing open issue by title, creates with gh issue create when absent, or refreshes body and adds a dated comment via gh issue edit + gh issue comment when found
• npm run lint:all passes (includes lint:ps and YAML lint)
• npm run test:ps -- -TestPath "scripts/tests/security/" passes

Prerequisites

scripts/security/Modules/SecurityHelpers.psm1 must exist. Get-CodeScanningAlerts.ps1 (delivered in #1418) imports this module for Invoke-GitHubAPIWithRetry and token validation.

References

• Research: .copilot-tracking/research/2026-04-09/github-security-scanning-backlog-research.md — Scenarios 1 and 3
• Pattern reference: .github/workflows/weekly-security-maintenance.yml (schedule/step pattern)
• Pattern reference: scripts/security/Modules/SecurityHelpers.psm1 (module usage)
• Completed dependency: feat(skills): add github-security code-scanning skill #1418 (Get-CodeScanningAlerts.ps1 and Pester tests)
• Deferred: analyses error tracking — see Add analyses error detection to the weekly code scanning workflow #1498