(MOT-3732) feat(security-scan): add scan controls and GitHub remediation

[rohitg00]

Summary

• add cancel, composer-model, and analysis-chat follow so a started scan can be stopped, uses the open chat model, and switches to the Security review session
• add recommended-fix follow-up plus approval-gated GitHub issue and draft fix-PR actions through existing github worker functions
• keep analysis unattended for allowlisted read functions, fail closed on GitHub mutations, and sanitize reports before persistence
• polish the injectable dashboard for narrow Console panes and honest error text

Test plan

• Start a scan with a blank SHA and confirm the form says entire-repo analysis at HEAD
• Confirm the scan uses the composer model and the Console switches to the Security review chat
• Cancel an in-flight scan from the dashboard
• On a completed report-only run with findings, use Get recommended fixes
• Create a GitHub issue from a finding and confirm Approval Gate still holds the mutation
• Create a draft fix PR from a suggest finding and confirm it stays gated

Fixes MOT-3732

Stacked on #807. Uses optional Console host chat APIs from #823. Calls existing github worker functions; no github/ source changes.

Summary by CodeRabbit

• New Features
  • Start scans from the repository’s latest commit or a specified commit.
  • Select analysis models and providers, with model-aware scan history and deduplication.
  • Added scan cancellation, retry, analysis chat, and conversation follow-up support.
  • Added GitHub issue and draft fix-PR actions with approval controls and status tracking.
  • Added detailed scan views, findings, remediation, suggestions, downloads, and reconciliation data.
  • Added optional run archiving and recovery.
• Bug Fixes
  • Improved error messages and validation for repository links, commits, archive paths, and GitHub URLs.
  • Improved responsive layouts and accessibility for narrow screens.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
workers	Ready	Preview	Aug 24, 2026 5:46pm
workers-tech-spec	Ready	Preview	Aug 24, 2026 5:46pm

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 97e885a8-be98-483d-bb4f-3def7b379a19

📥 Commits

Reviewing files that changed from the base of the PR and between 7b316a9 and 7b871cf.

⛔ Files ignored due to path filters (1)

• security-scan/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (67)

• security-scan/Cargo.toml
• security-scan/README.md
• security-scan/iii.worker.yaml
• security-scan/src/action.rs
• security-scan/src/action_executor.rs
• security-scan/src/analysis.rs
• security-scan/src/archive.rs
• security-scan/src/config.rs
• security-scan/src/configuration.rs
• security-scan/src/contract.rs
• security-scan/src/executor.rs
• security-scan/src/functions.rs
• security-scan/src/ids.rs
• security-scan/src/iii_runtime.rs
• security-scan/src/iii_runtime/archive_gateway.rs
• security-scan/src/iii_runtime/execution_runtime.rs
• security-scan/src/iii_runtime/git_gateway.rs
• security-scan/src/iii_runtime/security_runtime.rs
• security-scan/src/iii_runtime/tests.rs
• security-scan/src/iii_runtime/wire.rs
• security-scan/src/lib.rs
• security-scan/src/main.rs
• security-scan/src/runtime.rs
• security-scan/src/schedule.rs
• security-scan/src/service.rs
• security-scan/src/ui.rs
• security-scan/tests/action.rs
• security-scan/tests/action_executor.rs
• security-scan/tests/analysis_plan.rs
• security-scan/tests/config.rs
• security-scan/tests/executor.rs
• security-scan/tests/golden/schemas/security-scan.action-commit.json
• security-scan/tests/golden/schemas/security-scan.action-execute.json
• security-scan/tests/golden/schemas/security-scan.action-push.json
• security-scan/tests/golden/schemas/security-scan.action-read.json
• security-scan/tests/golden/schemas/security-scan.action.json
• security-scan/tests/golden/schemas/security-scan.analysis-chat.json
• security-scan/tests/golden/schemas/security-scan.cancel.json
• security-scan/tests/golden/schemas/security-scan.list.json
• security-scan/tests/golden/schemas/security-scan.read.json
• security-scan/tests/golden/schemas/security-scan.request.json
• security-scan/tests/manifest.rs
• security-scan/tests/reconciliation.rs
• security-scan/tests/request.rs
• security-scan/tests/schemas.rs
• security-scan/ui/src/page/ScanRequestForm.tsx
• security-scan/ui/src/page/SecurityFindingActions.tsx
• security-scan/ui/src/page/SecurityRunDetail.tsx
• security-scan/ui/src/page/SecuritySources.tsx
• security-scan/ui/src/page/errors.js
• security-scan/ui/src/page/errors.test.mjs
• security-scan/ui/src/page/icons.tsx
• security-scan/ui/src/page/index.tsx
• security-scan/ui/src/page/model-picker.js
• security-scan/ui/src/page/model-picker.test.mjs
• security-scan/ui/src/page/security-actions.js
• security-scan/ui/src/page/security-actions.test.mjs
• security-scan/ui/src/page/security-dashboard.js
• security-scan/ui/src/page/security-dashboard.test.mjs
• security-scan/ui/src/page/security-scan-data.ts
• security-scan/ui/src/page/useFollowAnalysisChat.ts
• security-scan/ui/src/page/useSecurityActions.ts
• security-scan/ui/src/page/useSecurityReconciliation.ts
• security-scan/ui/src/page/useSecurityRunsLive.ts
• security-scan/ui/src/page/view-state.js
• security-scan/ui/src/page/view-state.test.mjs
• security-scan/ui/styles.css

---

📝 Walkthrough

Walkthrough

The security-scan worker now supports model-aware HEAD scans, cancellation, analysis chat, approval-gated GitHub issues and draft fix PRs, durable action recovery, optional run archives, stronger report sanitization, and a Console interface for scan and finding workflows.

Changes

Security scan platform

Layer / File(s)	Summary
Contracts and scan lifecycle security-scan/src/contract.rs, security-scan/src/analysis.rs, security-scan/src/service.rs, security-scan/src/runtime.rs, security-scan/src/functions.rs, security-scan/src/ids.rs	Requests support optional models, providers, and HEAD targets. Run projections expose model and HEAD-resolution metadata. Cancellation, analysis chat, action contracts, model routing, and new function registrations are added.
Action planning and execution security-scan/src/action.rs, security-scan/src/action_executor.rs, security-scan/tests/action.rs, security-scan/tests/action_executor.rs, security-scan/tests/golden/schemas/security-scan.action*.json	Issue and fix actions use scoped capabilities, sanitized GitHub URLs, isolated worktrees, approval checks, Harness sessions, durable retries, publication idempotency, and terminal cleanup.
Runtime storage and recovery security-scan/src/iii_runtime/*, security-scan/src/archive.rs, security-scan/src/config.rs, security-scan/src/configuration.rs, security-scan/src/main.rs	The runtime adds action and archive scopes, action-session backfill, storage-backed run archives, worktree execution, Git commit and push operations, normalized GitHub reconciliation data, and startup recovery.
Scan execution safety security-scan/src/executor.rs, security-scan/tests/executor.rs	Materialization uses operation-specific requests. Cancellation finalizes through Harness shutdown. Exhausted turn budgets become retryable errors. Reports are sanitized before persistence.
Console scan and action experience security-scan/ui/src/page/*, security-scan/ui/styles.css	The Console adds scan creation, model selection, analysis-chat following, action state, run details, cancellation, finding actions, error formatting, URL validation, and responsive layouts.
Public contracts and supporting updates security-scan/README.md, security-scan/Cargo.toml, security-scan/iii.worker.yaml, security-scan/src/lib.rs, security-scan/tests/golden/schemas/*	The crate exports new action and archive APIs. Worker metadata adds runtime dependencies. Documentation and schemas describe the new scan, action, archive, and safety behavior.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant ScanConsole
  participant SecurityScanService
  participant SecurityRuntime
  participant SecurityActionExecutor
  participant Harness
  participant GitHub
  Operator->>ScanConsole: start scan
  ScanConsole->>SecurityScanService: submit model-aware request
  SecurityScanService->>SecurityRuntime: persist and enqueue run
  SecurityRuntime->>Harness: start analysis session
  Harness-->>SecurityRuntime: publish completed scan
  Operator->>ScanConsole: request issue or fix_pr
  ScanConsole->>SecurityScanService: submit action request
  SecurityScanService->>SecurityActionExecutor: enqueue action
  SecurityActionExecutor->>Harness: run approval-gated action
  Harness->>GitHub: commit or publish approved result
  GitHub-->>ScanConsole: expose sanitized action result

Loading

Poem

I’m a rabbit in the queue,
Sorting scans by model hue.
Safe paths, clean links, gates that glow,
Archives keep the runs in tow.
Actions hop when checks are right—
Then nap beneath the logs at night.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/security-scan-interactive-remediation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

skill-check — worker

0 verified, 66 skipped (no docs/).

Layer	Result
structure	✓
vale	✓
ai	✓
render	✓

Four for four. Nicely done.