fix(security): bind repository scanners to exact PR head

[seonghobae]

Purpose

Restore exact-head security evidence for organization-required repository scanners. DiskSage PR #137 exact head 87ac0e08cceed3d1a766da13a8f8123912178192 exposed that Security Scan run 31070907732 checked out GitHub's synthetic pull-request merge ref for Trivy instead of the literal contributor head, so the green result could not satisfy exact-head authorization policy.

Implemented boundary

• dependency-review support, Trivy, and Scorecard check out both the explicit pull-request head repository and immutable head SHA;
• persisted checkout credentials remain disabled;
• Trivy and Scorecard SARIF uploads explicitly bind refs/pull/<number>/head and the same exact head SHA;
• OSV's existing base/head comparison, dependency-review policy, Trivy severity gate, Scorecard soft posture role, permissions, scanner versions, and findings policy remain unchanged;
• fork pull requests remain read-only and supported through the event's explicit head repository.

TDD evidence

• RED head 3a1f49a6d5e07b2a3aedd42627579d3e4d3213ce: quality run 31078988647, job 92543220656, failed in Execute dependency-free exact-head contract because the three affected jobs still relied on the synthetic merge checkout.
• GREEN head aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae: quality run 31079215588, job 92543948287, passed both checkout and SARIF contracts.
• Security Scan run 31079215609 passed dependency-review, OSV, Trivy, and Scorecard. Trivy job 92544007320 checked out aee317b3ecbfaad7cdb3898e603dfe5e69b8f7ae and uploaded SARIF as refs/pull/799/head with the same SHA.

Documentation

docs/doctoring/security-scan-exact-head.md records the authorization boundary, fail-closed behavior, rollback contract, initiating DiskSage evidence, and APA 7th references to current authoritative GitHub documentation. CHANGELOG.md records the repair.

Merge gate

Keep Draft until the exact current head passes complete central tests, Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, SBOM, current-head automated review, independent non-author approval, zero unresolved valid findings, and branch protection without bypass.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 16 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bbc7ed60-4c81-419d-afe7-8f7584fd7787

📥 Commits

Reviewing files that changed from the base of the PR and between f070c50 and aee317b.

📒 Files selected for processing (6)

• .github/workflows/security-scan-exact-head-quality-ci.yml
• .github/workflows/security-scan.yml
• CHANGELOG.md
• docs/doctoring/security-scan-exact-head.md
• tests/test_security_scan_exact_head.py
• tests/test_security_scan_sarif_exact_head.py

---

_{Comment @coderabbitai help to get the list of available commands.}