ci(security): include bridge lockfiles in OSV scan

[tank321]

Summary

• Add the WhatsApp bridge lockfile to the OSV scan
• Add the Photon sidecar lockfile to the OSV scan
• Keep the current inline scanner and reporting steps from main

Fixes #46738.

Validation

• Parsed .github/workflows/osv-scanner.yml with PyYAML
• Confirmed all five configured lockfiles exist and are passed to the scanner
• Confirmed the scanner still uses continue-on-error: true
• Prettier passed
• zizmor reported no findings
• git diff --check passed

[alt-glitch]

Related: #46738 (the issue this fixes) and #39452 (earlier, narrower competing PR that scans only the whatsapp-bridge lockfile). This PR is the broader fix (whatsapp + photon bridges); both touch .github/workflows/osv-scanner.yml — reviewers should pick one.

[teknium1]

Thanks for identifying the uncovered runtime lockfiles. The premise still holds: .github/workflows/osv-scanner.yml:43-46 scans only three explicit lockfiles, while git ls-files '*package-lock.json' confirms the tracked WhatsApp and Photon bridge lockfiles.

Problems

• The trigger-path portion is stale. Commit 05c896cf524991f95c34ce73d2cbe985b5e0558f moved pull_request and push ownership to .github/workflows/ci.yml:13-16; .github/workflows/ci.yml:126-128 now invokes the OSV reusable workflow unconditionally, while osv-scanner.yml is workflow_call-only. The current PR is marked DIRTY.

Suggested changes

• Salvage the two --lockfile entries and update the source-count comment at .github/workflows/osv-scanner.yml:41-47; leave trigger configuration in ci.yml.

Automated hermes-sweeper review.

[tank321]

Updated this against current main. I removed the stale trigger changes and kept the patch focused on the two missing bridge lockfiles. The count comment now matches the five files being scanned.

Local checks passed: workflow assertions, lockfile parsing, Prettier, and zizmor. The new CI run is waiting for maintainer approval: https://github.com/NousResearch/hermes-agent/actions/runs/29355271472

[tank321]

Rebased this onto current main after the OSV workflow moved to inline scanner and reporter steps. The branch keeps that newer structure and only adds the two missing bridge lockfiles to the scanner input.

Local validation passed: YAML parsing, five-lockfile assertions, Prettier, zizmor, and git diff --check.

[tank321]

Rebased onto current main, which now uses Google's reusable OSV workflow. I kept that workflow structure and added only the two missing bridge lockfiles.

Local checks passed: the workflow YAML and package lockfiles parse, all five lockfile paths exist, Prettier passes, and git diff --check is clean. Zizmor reports the same existing findings as main; this patch adds none.

The new CI run is waiting for maintainer approval: https://github.com/NousResearch/hermes-agent/actions/runs/30465294563

[tank321]

This was incorporated directly into main in f21332f, so I’m closing the superseded PR. Thanks for carrying the change forward and preserving the attribution.