security: eliminate warning-class output from central Security Scan

[seonghobae]

Evidence

Current-head Naruon PR #1206 run 30637062852 completed with zero Medium-or-higher findings, but the central Security Scan log still contains strict-contract warning/fatal-class output:

• Trivy: [pip] Unable to find python site-packages directory. License detection is skipped.
• OSV Scanner v2.3.8: --output is deprecated in favor of --output-file for base/head scans.
• OSV Reporter v2.3.8: --output is deprecated in favor of --output-files.
• SARIF upload: local git attribution first emits fatal: bad object <synthetic merge sha> before falling back to server-side calculation.

The actual scan evidence was clean: Trivy 0 CRITICAL/HIGH/MEDIUM, dependency-review 0 moderate+, OSV reporter SARIF 0, open code-scanning alerts 0. This issue tracks log-contract remediation rather than a package/CVE finding.

Acceptance

• Replace deprecated OSV flags with their v2 forms.
• Run Trivy with its supported quiet/log-suppression input while retaining required SARIF output and the explicit parser that prints every Medium+ finding.
• Materialize and verify the PR synthetic merge object before SARIF upload so attribution does not emit handled fatal output.
• Add regression assertions and validate the reusable workflow with actionlint plus focused/full tests.
• Prove the change on a downstream current-head canary log.

[seonghobae]

Codex started the central warning-free Security Scan remediation on 2026-08-01 10:45 KST from exact downstream evidence in ContextualWisdomLab/naruon#1206. Project status: In Progress; Phase: Ops; Component: dot-github.

[seonghobae]

Implemented in #690 at current head 69ac38fe53ab7ba831c5bf7460373bab8e54ec79.

Live required-workflow canary: Security Scan run 30679412515.

• OSV base/head: 0 findings / 0 findings
• exact receipt: Verified synthetic merge attribution commit before OSV SARIF upload.
• OSV SARIF upload: success; no upload runtime failures
• Trivy: INPUT_HIDE_PROGRESS=true, scanners remain vuln,secret,misconfig, job success
• runtime search: no deprecated-output warning, pip license warning, or fatal: bad object; the only matched historical phrases were quoted in the PR description
• current-head pip-audit, dependency-review, OSV, Trivy, Bandit, Semgrep, CodeQL, and Gitleaks are green

Local verification remains 796/796 tests, 100% statement coverage, 100% docstrings, plus 0 OSV/Trivy/Gitleaks findings.

[seonghobae]

Fresh downstream reproduction confirms the SARIF attribution warning in this issue is still live on the current central Security Scan. LifeOS #247 exact 48087da1d1d5031374eacc12228d1a96f55359c0, Security run 34643498057, Trivy job 103408671264 verified the exact contributor head, then github/codeql-action/upload-sarif emitted fatal: bad object b01389498606377f3d6d6d453a5cd6e383988a03, fell back to server-side base resolution, and uploaded successfully.

This matches #689's existing acceptance to materialize/verify the PR synthetic merge object before SARIF upload rather than suppressing handled fatal output. LifeOS issue #278 should therefore remain a downstream canary/consumer-tracking issue, not a competing implementation owner. Please preserve exact contributor-head analysis, bounded provenance materialization, persist-credentials: false, and existing scanner gates; no broad history fetch or stderr filtering.

[seonghobae]

LifeOS-local AppGuardrail now has a concrete bounded implementation of the same provenance principle, without copying the central Security workflow. Draft LifeOS #279 first produced reality RED at ebedd2fc53a29070ce2067d42b53d5a297d9e605 / run 34648222331 / job 103424010024, then added a same-repository PR-only depth-1 fetch of refs/pull/<n>/merge, verifies FETCH_HEAD == github.sha and the commit object, never checks out the merge commit, and preserves contributor-head SARIF ref/sha.

Exact local candidate e4a7ddcdf55a02ccbebd70f7654a529578b27db2, run 34649865068 / job 103429245032, is GREEN: 26 suites / 78 tests, typecheck, build and git diff --check; temporary verifier is retired at 76e352ed063bcbf48be6061e2f0bf9edaa47ece7. The local runtime-warning canary remains pending until its parent #276 integrates and #279 can retarget to main normally. Central #689 remains the implementation owner for the organization Security Scan; please retain its own current-head/synthetic-merge identity verification rather than consuming mutable LifeOS source.