[jonahgabriel]

Ticket: OMN-10445

Summary

• standardize the OCC self-scan CodeQL job onto the centralized runner selector contract
• preserve the protected required check context CodeQL / CodeQL Analysis (python) while avoiding one-off hardcoded runner labels
• keep action versioning aligned with the rest of the OCC workflow estate instead of pinning local SHAs in this PR

Verification

• actionlint .github/workflows/security-scan.yml .github/workflows/codeql-reusable.yml
• grep guard confirmed no bare ubuntu or self-hosted runner labels in the touched CodeQL workflows
• pre-commit hooks passed during commit

Summary by CodeRabbit

• Chores
  • Updated security scanning workflow to perform CodeQL analysis inline using updated GitHub Actions, with explicit runner selection and improved analysis configuration; workflow job renamed for clearer Python-focused CodeQL reporting.

[coderabbitai]

📝 Walkthrough

Walkthrough

Replaces the reusable CodeQL workflow call in .github/workflows/security-scan.yml with an inline jobs.codeql definition that uses actions/checkout@v6 and github/codeql-action/{init,autobuild,analyze}@v4, sets languages: python and queries: security-and-quality, and adjusts name and runs-on expression; job permissions unchanged.

Changes

CodeQL Workflow Inline Migration

Layer / File(s)	Summary
Job metadata / Runner selection .github/workflows/security-scan.yml	jobs.codeql.name changed to CodeQL / CodeQL Analysis (python) and runs-on now uses a conditional expression selecting from vars.OMNI_*_RUNS_ON_JSON based on github.event_name.
Core Steps: checkout & init .github/workflows/security-scan.yml	Replaced reusable workflow with explicit steps: actions/checkout@v6, github/codeql-action/init@v4 with languages: python and queries: security-and-quality.
Core Steps: build & analyze .github/workflows/security-scan.yml	Added github/codeql-action/autobuild@v4 and github/codeql-action/analyze@v4 with category: /language:python.
Permissions / continuity .github/workflows/security-scan.yml	Job-level permissions (actions: read, contents: read, security-events: write) retained from previous configuration.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 I hopped through YAML, neat and spry,
Swapped a reuse for steps nearby.
Checkout, init, build, then scan,
Python queries run by hand.
A tiny change, a tidy sky.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title 'ci(OMN-10445): standardize OCC security scan runner routing' directly relates to the main change of converting the CodeQL job from a reusable workflow to inline steps with explicit runner routing based on environment variables.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/omn-10445-occ-pr515-receipt

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/security-scan.yml:
- Around line 37-49: The workflow currently uses mutable tags for actions
(actions/checkout@v6 and github/codeql-action/init@v4,
github/codeql-action/autobuild@v4, github/codeql-action/analyze@v4); replace
each of those uses: entries with the corresponding immutable full commit SHA for
the specific release (e.g., actions/checkout@<full-sha>,
github/codeql-action/init@<full-sha>, github/codeql-action/autobuild@<full-sha>,
github/codeql-action/analyze@<full-sha>) by looking up the commit SHAs from the
actions' canonical GitHub repos/tags and update all four occurrences so the
workflow pins to exact commits rather than major-version tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c7e683ac-df66-41f5-95c2-e249abc9185c

📥 Commits

Reviewing files that changed from the base of the PR and between a985a45 and 76449c6.

📒 Files selected for processing (1)

• .github/workflows/security-scan.yml