Stabilize Sighthound Security Scan by scanning a clean archived repo snapshot

[Copilot]

The Sighthound Security Scan workflow was failing immediately after launch because Sighthound was scanning the live checkout and tripping on checkout artifacts, producing action_required runs without actionable findings. This change isolates the scan input so the workflow only escalates on real scan output.

• Root cause

  • Sighthound was run against the live workspace (.), where checkout byproducts and symlink-heavy paths could trigger an internal panic in its path handling.
  • In the failure mode, the scan exited non-zero with no findings, but still flowed through the workflow as if triage might continue.

• Workflow changes

  • Add a pre-scan step that creates a clean repository snapshot with git archive into /tmp/gh-aw/sighthound/repo.
  • Run Sighthound against that archived tree instead of the mutable checkout.
  • Promote the scan root to a job-level env var so both steps share the same path.
  • Preserve the existing findings artifact flow for downstream triage.

• Failure semantics

  • If Sighthound exits non-zero and produces no findings, fail the scan job immediately.
  • Keep the existing findings-based gating for the agent path unchanged when valid output exists.
  • Include the scan root in the generated summary for easier diagnosis of future failures.

env:
  SCAN_ROOT: /tmp/gh-aw/sighthound/repo

- name: Prepare clean scan root
  run: |
    rm -rf "$SCAN_ROOT"
    mkdir -p "$SCAN_ROOT"
    git archive --format=tar HEAD | tar -xf - -C "$SCAN_ROOT"

- name: Run Sighthound scan
  run: |
    sighthound --output-format json "$SCAN_ROOT" > "$RESULTS_JSON"
    if [ "$SCAN_EXIT" -ne 0 ] && [ "$FINDINGS_COUNT" -eq 0 ]; then
      exit "$SCAN_EXIT"
    fi

[Copilot]

Pull request overview

This PR isolates Sighthound scans from checkout artifacts using an archived repository snapshot.

Changes:

• Creates and scans a clean git archive snapshot.
• Fails scans that exit unsuccessfully without findings.
• Adds scan-root diagnostics and recompiles the workflow.

Show a summary per file

File	Description
.github/workflows/sighthound-security-scan.md	Updates scan preparation and failure handling.
.github/workflows/sighthound-security-scan.lock.yml	Regenerates the compiled workflow.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium