fix(ci): secure code-scan action releases

[mldangelo-oai]

Summary

• Pin and verify the released code-scan action before mirroring it.
• Restrict mirrored paths and credentials while preserving release provenance.
• Clean up the isolated CLI installation on both success and failure without masking scan results, handle installation paths containing spaces, cover the attestation/payload/permission gate and action error paths, and refresh the release documentation.

Validation

• Focused action/release-workflow tests: 71 passed, plus a path-with-spaces execution smoke test
• Action build, TypeScript, architecture, and formatting checks passed

[Copilot]

Pull request overview

This PR hardens the code-scan-action release/mirroring pipeline by enforcing provenance checks, restricting what gets mirrored into the external action repo, and tightening the action runtime’s CLI installation and cleanup behavior.

Changes:

• Updates the release-please workflow to build and upload a complete mirror payload, gate publication on an isolated provenance attestation step, and restrict mirrored paths/credentials.
• Hardens the GitHub Action runtime install by isolating the npm install prefix/registry, ensuring cleanup on success/failure, and adding coverage for cleanup and error paths.
• Refreshes documentation with stricter attestation verification commands and adds regression tests to enforce the workflow gates.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/release-please.test.ts	Adds assertions that code-scan mirroring is gated on isolated attestation and that token usage/order is constrained.
test/code-scan-action/main.test.ts	Adds coverage for cleanup on success/failure, “cleanup blocked” behavior, and RUNNER_TEMP paths with spaces.
site/docs/code-scanning/github-action.md	Updates attestation verification guidance with stricter gh attestation verify flags.
code-scan-action/src/main.ts	Implements isolated CLI install prefix/registry, returns installed binary path, adds cleanup in finally, and attempts to handle paths with spaces.
code-scan-action/README.md	Updates attestation verification commands to match the hardened workflow provenance expectations.
.github/workflows/release-please.yml	Splits build/attest/publish jobs for code-scan-action, uploads full payload, gates publish on attestation, restricts mirrored paths, and pins npm registry usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jameshiester-oai]

No actionable findings.

I reviewed the release workflow sequencing, credential boundaries, mirrored-path allowlist, attestation payload, action-owned CLI prefix, direct executable invocation, cleanup behavior, tests, and user-facing supply-chain documentation. The build-attest-publish split is coherent: the foreign-repo token is minted only after the payload is built and attested, and mirror publication is constrained to the intended generated paths. I did not find a regression, unintended behavior change, documentation mismatch, or worthwhile simplification that should block this head.

Validation:

• Node 24.18: focused Vitest passed (2 files, 62 tests).
• code-scan-action TypeScript checks passed after installing its local dependencies.
• git diff --check passed.
• Current GitHub checks are green.

No inline comments.

The requested full PR-review command was unavailable on this host, so I applied the manual full-review lenses: correctness, regression/edge-case behavior, tests, docs, error handling, API/types, and simplification.