fix(release): merge develop into main

[bedatty]

GitHub Actions Shared Workflows

---

Description

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @develop or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

Summary by CodeRabbit

• New Features

  • Added CodeQL Analysis as an optional security scan with configurable language support and optional SARIF upload to GitHub Security tab.
  • Added Pre-release Version Check to detect and block PRs with unstable dependency versions targeting specified branches.

• Documentation

  • Updated security scan workflow documentation to document new CodeQL and pre-release check features, inputs, and configuration options.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

The PR updates multiple GitHub Actions workflow files by pinning action references to specific commit SHAs, adds a new prerelease-check composite action to scan dependency files for unstable version pins, integrates CodeQL analysis into the PR security scan workflow, and extends security reporting to handle pre-release findings alongside existing Trivy and health score checks.

Changes

Cohort / File(s)	Summary
Workflow Action Pinning .github/workflows/build.yml, go-release.yml, gptchangelog.yml, helm-update-chart.yml, release-notification.yml, release.yml, typescript-release.yml	Updates to docker/build-push-action@v7 and actions/create-github-app-token@v3 with new commit SHA pins (v3.0.0→v3.1.1 for some); preserves action logic and inputs.
Self-PR Validation Workflow .github/workflows/self-pr-validation.yml	Pins actions/checkout@v6 to commit SHA across all job steps; adds upload: 'true' input to CodeQL analyze step.
PR Security Scan Workflow .github/workflows/pr-security-scan.yml	Adds new workflow_call inputs for CodeQL (enable_codeql, codeql_languages, codeql_fail_on_findings, codeql_upload_sarif) and pre-release checks (enable_prerelease_check, prerelease_block_branches); introduces conditional codeql_scan job; adds pre-release version check step with conditional failure gate; updates job dependencies and reporting logic.
CodeQL Composite Actions src/security/codeql-init/action.yml, src/security/codeql-analyze/action.yml	Pins CodeQL action references to commit SHAs (v4); codeql-analyze adds new upload input to control SARIF upload.
Pre-release Check Composite Action src/security/prerelease-check/action.yml	New composite action that scans go.mod, package.json, and Dockerfile for unstable version pins; outputs findings to JSON artifact and emits GitHub annotations/warnings.
Security Reporter src/security/pr-security-reporter/action.yml	Adds prerelease-findings-file input; implements buildPrereleaseScan() to render pre-release findings in PR comments with 50-entry cap; appends results to report body.
Documentation docs/pr-security-scan-workflow.md, src/security/prerelease-check/README.md	Replaces Docker Scout with CodeQL in examples; documents new pre-release version gate (enabled by default, branch-configurable blocking); adds inputs/outputs tables for CodeQL and pre-release checks; new README for prerelease-check action with pattern definitions and usage examples.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~70 minutes

Possibly related PRs

• feat(security): add CodeQL analysis and pre-release version gate #208 — Modifies pr-security-scan.yml and integrates CodeQL/pre-release checks into the same security workflow pipeline.
• feat(security): add CodeQL composites and integrate into pr-security-scan #162 — Adds CodeQL composite actions (codeql-init, codeql-analyze) that are referenced in this PR's workflow integration.
• feat(security): add Docker Scout scan composite and integrate into pr-security-scan workflow #142 — Updates pr-security-scan.yml and pr-security-reporter composite action with overlapping security reporting changes.

Suggested labels

workflow, security, dependencies, documentation, golang, size/L

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title 'fix(release): merge develop into main' describes a merge operation, not the actual substantive changes (security scanning enhancements, CodeQL integration, prerelease checks, and dependency pinning updates).	Use a title reflecting the primary changes: e.g., 'feat: add CodeQL analysis and prerelease version gating to security workflow' or similar to capture the actual scope.
Description check	⚠️ Warning	The description checks multiple boxes (feat, fix, refactor) but provides no content in the Description section explaining what the PR does, which workflows are affected, or what behavior changes. Testing section is complete with all boxes checked, but the core description is empty.	Fill the Description section with details of the changes: explain CodeQL integration, prerelease gating, action upgrades, and which workflows are modified.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 3 issue(s): 3 Medium

Severity	Rule	File	Message
🟡 Medium	actions/missing-workflow-permissions	.github/workflows/release-notification.yml:110	Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. C...
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/go-release.yml:127	Potential unsafe checkout of untrusted pull request on privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/helm-update-chart.yml:155	Potential unsafe checkout of untrusted pull request on privileged workflow.

---

_{🔍 View full scan logs | 🛡️ Security tab}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	13 file(s)	✅ success
Action Lint	9 file(s)	✅ success
Pinned Actions	13 file(s)	✅ success
Markdown Link Check	2 file(s)	✅ success
Spelling Check	15 file(s)	✅ success
Shell Check	13 file(s)	✅ success
README Check	13 file(s)	✅ success
Composite Schema	4 file(s)	✅ success

⚠️ Warnings (7)

Pinned Actions

.github

• .github (line 97) — Found 6 internal action(s) not pinned to a version. Consider pinning to vX.Y.Z.

.github/workflows/pr-security-scan.yml

• .github/workflows/pr-security-scan.yml (line 323) — Internal action not pinned to a version: uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-reporter@feat/pr-security-scan-codeql-prerelease
• .github/workflows/pr-security-scan.yml (line 315) — Internal action not pinned to a version: uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-analyze@feat/pr-security-scan-codeql-prerelease
• .github/workflows/pr-security-scan.yml (line 296) — Internal action not pinned to a version: uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-init@feat/pr-security-scan-codeql-prerelease
• .github/workflows/pr-security-scan.yml (line 289) — Internal action not pinned to a version: uses: LerianStudio/github-actions-shared-workflows/src/security/codeql-config@feat/pr-security-scan-codeql-prerelease
• .github/workflows/pr-security-scan.yml (line 234) — Internal action not pinned to a version: uses: LerianStudio/github-actions-shared-workflows/src/security/pr-security-reporter@feat/pr-security-scan-codeql-prerelease
• .github/workflows/pr-security-scan.yml (line 225) — Internal action not pinned to a version: uses: LerianStudio/github-actions-shared-workflows/src/security/prerelease-check@feat/pr-security-scan-codeql-prerelease

---

_{🔍 View full scan logs}