fix(actions/threatcrush-scan): ship the converter to an allowed destination

Every test in packages/actions failed with "Invalid action-pack manifest:
1 issue(s)" — the pack sent threatcrush-to-sarif.py to .github/, which the
destination allowlist rejects. Because each test loads the whole catalog,
one bad manifest took all 15 down, including the four unrelated packs.

Move the converter to .github/scripts/ and update the workflow, README and
test expectations to match.

Also fix the pull_request_target assertion, which the manifest error had
been masking: it substring-matched the entire rendered workflow, so the
comment explaining why the pack deliberately stays on `pull_request`
tripped it. Strip comments first and assert on the trigger block, so the
check tests the directive rather than forbidding its own rationale.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

packages/actions/src/index.test.ts

@@ -41,7 +41,7 @@ describe('built-in packs', () => {
     // Workflow plus the legacy-output converter it falls back to.
     expect(entry?.manifest.files.map((f) => f.destination)).toEqual([
       '.github/workflows/threatcrush-scan.yml',
-      '.github/threatcrush-to-sarif.py',
+      '.github/scripts/threatcrush-to-sarif.py',
     ]);
   });
 
@@ -215,7 +215,7 @@ describe('built-in packs', () => {
     expect(content).toContain('if [ ! -s threatcrush.sarif ]; then');
     // A CLI without --format takes the converter path rather than failing the
     // repo out of being scanned at all.
-    expect(content).toContain('.github/threatcrush-to-sarif.py');
+    expect(content).toContain('.github/scripts/threatcrush-to-sarif.py');
     expect(content).toContain('this diff was NOT scanned');
     // And the report must be fail-closed. Testing for status == "error" was
     // fail-open: when the capability check fails the scan step is *skipped*,
@@ -236,7 +236,16 @@ describe('built-in packs', () => {
       manifest: entry.manifest,
       inputs: {},
     });
-    expect(result.files[0]?.content).not.toContain('pull_request_target');
+    // Comments are stripped first: the workflow documents why it stays on
+    // `pull_request`, and a raw substring check would forbid explaining the
+    // very decision it exists to protect. What matters is that no directive
+    // selects the event.
+    const directives = (result.files[0]?.content ?? '')
+      .split('\n')
+      .filter((line) => !/^\s*#/.test(line))
+      .join('\n');
+    expect(directives).not.toContain('pull_request_target');
+    expect(directives).toMatch(/^on:\n\s+pull_request:\s*$/m);
     expect(entry.manifest.security.allowPullRequestTarget).toBe(false);
   });
 });

packages/actions/threatcrush-scan/README.md

@@ -34,7 +34,7 @@ scanning, and picks accordingly:
 | CLI | Path |
 | --- | --- |
 | Has `--format` | Native SARIF. Preferred; nothing is parsed. |
-| Older | Runs the text scan and converts it with `.github/threatcrush-to-sarif.py`. |
+| Older | Runs the text scan and converts it with `.github/scripts/threatcrush-to-sarif.py`. |
 
 The check happens up front because exit codes cannot tell the two failures
 apart. The published `0.2.2` has no `--format`: the scan died with

packages/actions/threatcrush-scan/sh1pt.actionpack.yaml

@@ -63,7 +63,7 @@ files:
   # the native path whenever it is available — but shipping it means a repo is
   # scanned today rather than waiting on a release.
   - source: threatcrush-to-sarif.py
-    destination: .github/threatcrush-to-sarif.py
+    destination: .github/scripts/threatcrush-to-sarif.py
     mergeStrategy: replace-managed
 policies:
   installMode: pull-request

packages/actions/threatcrush-scan/workflow.yml

@@ -91,7 +91,7 @@ jobs:
               # every finding reads as out-of-scope.
               PREFIX="$SCAN_PATH"
             fi
-            python3 .github/threatcrush-to-sarif.py \
+            python3 .github/scripts/threatcrush-to-sarif.py \
               --input threatcrush-output.txt \
               --output threatcrush.sarif \
               --path-prefix "$PREFIX" \