The weekly code scanning workflow (weekly-gh-code-scanning.yml) surfaces open alert findings via /code-scanning/alerts but silently misses SARIF upload failures and CodeQL runner errors. These errors are only visible via the /code-scanning/analyses endpoint's error field. A Check for scan analysis errors step was drafted during PR #1495 but deferred due to unresolved design questions around time-windowing, deduplication, skill ownership, and response scope.
Acceptance Criteria
Open questions / risks / dependencies
Evidence source: stakeholder input — deferred from PR #1495 review; requirement is unvalidated beyond the originating PR discussion.
The weekly code scanning workflow (
weekly-gh-code-scanning.yml) surfaces open alert findings via/code-scanning/alertsbut silently misses SARIF upload failures and CodeQL runner errors. These errors are only visible via the/code-scanning/analysesendpoint'serrorfield. ACheck for scan analysis errorsstep was drafted during PR #1495 but deferred due to unresolved design questions around time-windowing, deduplication, skill ownership, and response scope.Acceptance Criteria
-IncludeAnalysisErrorsswitch toGet-CodeScanningAlerts.ps1or implemented as workflow-only inline logicOpen questions / risks / dependencies
gh-code-scanningskill (Get-CodeScanningAlerts.ps1) via a new parameter, or remain workflow-only inline logic?Evidence source: stakeholder input — deferred from PR #1495 review; requirement is unvalidated beyond the originating PR discussion.