fix: unique CodeQL IDs, richer descriptions, exclude cancelled Linear issues

- CodeQL alert IDs now include alert number (codeql:rule#N) so each
  alert gets its own Linear issue instead of being grouped by rule
- Enhanced Claude prompt for CodeQL: explicit per-alert treatment,
  detailed description requirements (file, lines, code, remediation)
- Linear dedup query now filters out cancelled issues so rejected
  findings can be re-triaged

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: msukkari

.github/workflows/trivy-vulnerability-triage.yml

@@ -344,7 +344,7 @@ jobs:
             fi
 
             EXTRACTED=$(echo "$BODY" | jq '[.[] | {
-              id: ("codeql:" + (.rule.id // "")),
+              id: ("codeql:" + (.rule.id // "") + "#" + ((.number // 0) | tostring)),
               number: .number,
               rule_id: (.rule.id // ""),
               rule_description: (.rule.description // ""),
@@ -405,7 +405,7 @@ jobs:
 
             1. **Trivy scan results** in `trivy-alerts.json` — each entry has `id` (CVE ID, e.g., `CVE-2024-1234`)
             2. **Dependabot alerts** in `dependabot-alerts.json` — each entry has `id` (CVE ID or GHSA ID)
-            3. **CodeQL alerts** in `codeql-alerts.json` — each entry has `id` (prefixed, e.g., `codeql:js/sql-injection`)
+            3. **CodeQL alerts** in `codeql-alerts.json` — each entry has `id` (prefixed, e.g., `codeql:js/sql-injection#33`)
 
             ## Your Task
 
@@ -422,12 +422,19 @@ jobs:
                - Include the affected package, severity, remediation steps, and whether it is direct or transitive.
 
             4. For **CodeQL findings**:
-               - Use the `id` field as `cveId` (already prefixed with `codeql:`).
+               - Each CodeQL alert is a **separate finding** — do NOT group alerts by rule ID. Two alerts with the
+                 same rule but different files/locations must be separate entries.
+               - Use the `id` field as `cveId` (e.g., `codeql:js/path-injection#18`).
                - Set `source` to `"codeql"`.
-               - Include the file location (path and line numbers) and rule description in the `description`.
-               - Include the alert URL for reference.
-               - Use `affectedPackage` to indicate the file path where the issue was found.
+               - Set `affectedPackage` to the file path from `location_path`.
                - Normalize `security_severity_level` to uppercase (CRITICAL/HIGH/MEDIUM/LOW).
+               - The `description` should include:
+                 - The rule ID and what it detects
+                 - The exact file path and line number(s) from the alert
+                 - A link to the alert URL (`html_url`)
+                 - An explanation of the specific code at that location and why it's flagged
+                 - Concrete remediation steps with code examples where possible
+                 - A link to the CodeQL rule documentation
 
             5. For each finding, determine:
                - A short `title` suitable for a Linear issue title.
@@ -438,14 +445,16 @@ jobs:
                dependencies. Use `yarn why <package> --recursive` to determine why an npm package is included.
 
             7. **Check Linear for existing issues** for each finding:
-               - For each `cveId` (whether CVE ID, GHSA ID, or `codeql:<rule_id>`), run a GraphQL query
-                 against the Linear API to search for issues whose title contains that ID.
+               - For each `cveId`, run a GraphQL query against the Linear API to search for issues
+                 whose title contains that ID.
+               - **Important**: Exclude cancelled issues so that previously cancelled/rejected findings
+                 can be re-created. Use a state type filter to only match active issues.
                - Use the following curl command pattern:
                  ```
                  curl -s -X POST https://api.linear.app/graphql \
                    -H "Content-Type: application/json" \
                    -H "Authorization: $LINEAR_API_KEY" \
-                   -d '{"query": "query { issues(filter: { team: { id: { eq: \"'$LINEAR_TEAM_ID'\" } }, title: { contains: \"<ID>\" } }) { nodes { id title } } }"}'
+                   -d '{"query": "query { issues(filter: { team: { id: { eq: \"'$LINEAR_TEAM_ID'\" } }, title: { contains: \"<ID>\" }, state: { type: { nin: [\"canceled\"] } } }) { nodes { id title } } }"}'
                  ```
                - Set `linearIssueExists` to `true` if any matching issue is found, `false` otherwise.