feat(scanner): emit Actions poll analyzer findings without double-count

[seonghobae]

Successor of #1133 / G-06 / issue #1087. This stacked slice hooks classify_poll_loops into production _scan_file for GitHub Actions workflows and merges regex plus analyzer hits by (rule_id, file) so the packaged #1088 corpus is not double-counted.

This pull request does not Close #1087 or #1088. It does not Close #1133.

What this adds

• Production _scan_file also runs the structural poll-loop classifier on .github/workflows/*.{yml,yaml}
• Finding rule IDs remain github-actions-transport-only-poll-bound and github-actions-transport-failure-budget-poll-bound
• Deterministic merge keyed by (rule_id, file): if regex and analyzer would both report the same identity, emit once
• Analyzer-only positives that regex adjacency misses: split while/do helper loops, reversed comparisons, unreachable fail-closed exits, quoted decoys next to a real poll
• Quoted/comment/heredoc-only text stays negative; the historical fixed fixture stays negative for both IDs
• Unconditional top-level break/exit/return remains a finite success-path terminator so existing security(actions): detect transport-only verdict poll bounds #1088 regex tests still pass
• Regex YAML is unchanged

Verification

• Historical vulnerable fixture: _scan_file count of github-actions-transport-only-poll-bound is 1
• Historical fixed fixture: both poll-bound IDs absent
• Focused tests: tests/test_actions_poll_analyzer_emit.py, tests/test_actions_poll_structural_analyzer.py, and the existing security(actions): detect transport-only verdict poll bounds #1088 poll regex corpus
• appguardrail_core/actions_poll_analyzer.py remains 100% statement and branch coverage

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}