ci: replace unmaintained rsdmike/github-security-report-action [TECHOPS-553]

[sayaliM0412]

What

Replaces rsdmike/github-security-report-action@v3.0.4 in the CodeQL workflow with an inline, self-maintained step.

Why

Part of TECHOPS-553 (under TECHOPS-81). The enterprise is enabling an Actions allowlist plus "Require actions to be pinned to a full-length commit SHA". rsdmike/github-security-report-action is published by a personal account, so it can never qualify as a Marketplace verified creator, and the project is unmaintained. It would be blocked by the policy, so we replace it rather than allowlist it.

Change

• Perform CodeQL Analysis: added output: sarif-results so the SARIF is written locally (still uploaded to the Security tab; upload defaults to always).
• Replaced the Generate Security Report (PDF) step with Summarize CodeQL results: an inline jq step that writes a per-language findings summary to the GitHub job summary.
• Renamed Upload Security Report to Upload CodeQL SARIF: uploads the raw SARIF directory instead of summary.pdf.
• Both new steps keep if: always() + continue-on-error: true, matching the prior best-effort behaviour.

No third-party report action remains in this workflow.

Test

• actionlint passes (only the pre-existing actions/checkout@v3 / setup-java@v3 "too old" warnings remain; those are tracked separately under TECHOPS-555).
• CodeQL analysis and Security-tab upload behaviour unchanged.

🤖 Generated with Claude Code

[claude]

Claude finished @sayaliM0412's task in 34s —— View job

---

Code Review

LGTM - no significant issues found. The replacement is clean:

• ✅ Inline jq-based summary properly replaces the external action while preserving functionality
• ✅ Error handling is robust with continue-on-error: true and if: always() matching original behavior
• ✅ Defensive jq filters use // operators to handle missing/null values safely
• ✅ SARIF upload switched correctly to artifact storage with the new output: sarif-results parameter
• ✅ Job summary output is a practical replacement for the PDF report with better integration into GitHub UI

[claude]

Claude finished @sayaliM0412's task in 47s —— View job

---

Code Review

LGTM - no significant issues found. The replacement is clean:

• ✅ All actions properly SHA-pinned to full commit hashes with version comments for traceability
• ✅ Inline jq-based summary correctly replaces external action while preserving functionality (collapsible markdown output in job summary)
• ✅ Error handling robust with continue-on-error: true and if: always() matching original behavior
• ✅ Defensive jq filters use // operators and error suppression (|| true, 2>/dev/null) to handle missing/null SARIF values safely
• ✅ SARIF artifact upload correctly switched from PDF to raw sarif-results directory with proper output: sarif-results parameter in CodeQL analysis step

The workflow maintains backward compatibility with existing CodeQL scanning while removing the unmaintained third-party dependency. The per-language finding summaries in the job summary provide better GitHub integration than the previous PDF reports.

[claude]

Claude finished @sayaliM0412's task in 46s —— View job

---

Code Review

LGTM - no significant issues found. The replacement is clean:

• ✅ All actions properly SHA-pinned to full commit hashes with version comments for traceability
• ✅ Inline jq-based summary correctly replaces external action while preserving functionality (collapsible markdown output in job summary)
• ✅ Error handling robust with continue-on-error: true and if: always() matching original behavior
• ✅ Defensive jq filters use // operators and error suppression (|| true, 2>/dev/null) to handle missing/null SARIF values safely
• ✅ SARIF artifact upload correctly switched from PDF to raw sarif-results directory with proper output: sarif-results parameter in CodeQL analysis step

The workflow maintains backward compatibility with existing CodeQL scanning while removing the unmaintained third-party dependency. The per-language finding summaries in the job summary provide better GitHub integration than the previous PDF reports.