[dborowitz]

Adds .github/workflows/action-security-scan.yaml. It runs the same 6-rule codeql/actions-queries suite as the Alphabet enterprise Google GitHub Admin: Actions Workflow Security Scan, on pull requests where github.base_ref != github.event.repository.default_branch.

Why

The enterprise scan only runs on PRs that target the default branch, or that belong to a native GitHub stack based on main. Two kinds of PR therefore went unscanned before merge:

• branch-stacked PRs, e.g. fix(windows): support artifact uploads, PyPI installation, and VS Code IDE detection on Windows #218, which broke the /gcbrun guard (fixed in ci: move /gcbrun authorization to ubuntu gate job and harden permissions, cache, and concurrency #221)
• backport PRs that target release branches

This workflow covers exactly those cases. It needs no API calls, so it also catches a stacked PR on its first push.

Notes

• Fails the check on findings. It doesn't upload SARIF, so it needs only contents: read and no security-events: write. It is not added as a required check.
• Scope. This workflow handles Actions workflow security scanning only. Test and lint workflows on release branches stay governed by whatever each branch defines.
• Dogfooding. This PR is stacked on ci: move /gcbrun authorization to ubuntu gate job and harden permissions, cache, and concurrency #221, so the new workflow runs on it.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.