[Sanjana-Kondalwade]

What type of PR is this? (check all applicable)

• Refactor
• Feature
• Bug Fix
• Optimization
• Content Update

Category

• zopen build framework
• zopen package manager
• Documentation
• CI/CD
• Tools

Description

This PR introduces a standard, native GitHub Actions workflow for on-demand CodeQL Alert Triage & Remediation across zopencommunity port repositories (modeled after the architecture used in community_digest.yml).

Key Capabilities

1. Manual / On-Demand Execution:
   • Maintainers can trigger triage from the GitHub Actions tab UI (workflow_dispatch) by specifying a repository (e.g. curlport) and optional alert_number.
   • Maintainers can also trigger triage directly in issue/PR comments using slash commands: /codeql <repo> or /analyze-codeql <repo> alert:<number>.
2. False Positive Evaluation & Code Context:
   • Uses tools/codeql_alert_triage.py to fetch open CodeQL alerts via the GitHub Code Scanning API, extract the relevant source code window (±25 lines), and assess whether findings are False Positives (e.g. bounded upstream checks, unreachable test code, or benign z/OS-specific ASCII/EBCDIC behaviors).
3. Automated Fix Generation:
   • For confirmed real vulnerabilities, generates copy-pasteable unified diff patches and z/OS-tailored remediation guidance in the GitHub Actions Job Summary and optional issue comment.

Changes Included

• .github/workflows/codeql_alert_triage.yml: Standard native GitHub Actions workflow file for on-demand execution and comment triggering without requiring extra lockfiles.
• Replaces the experimental .md workflow definition with standard .yml.

Related Issues

• Related Issue #
• Closes #

[optional] Are there any post-deployment tasks or follow-up actions required?

None. The workflow is immediately usable from the GitHub Actions tab once merged into main.

[Copilot]

🟡 Changes recommended

The workflow lets unauthorized commenters trigger privileged Copilot runs and masks cross-repository alert access failures as successful zero-alert reports.

4 open issues

• Missing commenter authorization enables privileged command abuse · New
• Collector token cannot access sibling repository CodeQL alerts · New
• Fallback GITHUB_TOKEN lacks Copilot request permissions · New
• Unsupported Copilot CLI flag hides failed verdict generation · New

What changed in this PR

Replaces the experimental CodeQL triage definition with a native GitHub Actions workflow intended to analyze alerts and suggest remediation across zopen port repositories.

Changes:

• Adds manual dispatch and /codeql or /analyze-codeql comment triggers.
• Connects the existing alert collector to Copilot-based analysis, job summaries, and optional issue/PR comments.
• Removes the Markdown workflow definition.

File	Description
.github/​workflows/​zopen-codeql-triage.md	Removes the experimental agent workflow.
.github/​workflows/​codeql_alert_triage.yml	Adds native workflow triggers, alert collection, AI triage, and report publishing.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The workflow risks exposing private-repository security details to unauthorized requesters, uses an unsupported Copilot CLI runtime, and has unresolved argument-parsing and report-handling defects.

3 open issues

• Use Node.js 22 or later for Copilot CLI · New
• Verify requester access to target repositories · New
• Reject partial Copilot output after CLI failure · New

2 previously missed issues

In code that hasn't changed since last review

Parse slash-command alert arguments correctly

.github/​workflows/​codeql_alert_triage.yml:75

This regex searches the entire comment instead of parsing the alert argument: /codeql alert123port incorrectly selects alert #123, while /analyze-codeql curlport 42, documented by the existing parser, silently ignores the requested alert number. Reuse parse_slash_command_args so repository names cannot supply the alert number and the existing numeric/#number forms remain supported.

Handle reports exceeding GitHub comment limits

.github/​workflows/​codeql_alert_triage.yml:142

The report can exceed GitHub's 65,536-character issue-comment limit, especially with the default 15 alerts and their source snippets. Posting an oversized report fails with HTTP 422, so the slash command never posts its result. For oversized reports, post a short link to the full workflow summary instead.

4 resolved since last review

• Collector token cannot access sibling repository CodeQL alerts
• Missing commenter authorization enables privileged command abuse
• Unsupported Copilot CLI flag hides failed verdict generation
• Fallback GITHUB_TOKEN lacks Copilot request permissions

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The repository visibility check fails open for a crafted --repo value, potentially exposing private code-scanning alert details in public job summaries or issue comments.

1 open issue

• Verify requester access to target repositories

1 previously missed issue

In code that hasn't changed since last review

Prevent alert disclosure for private repositories

tools/​codeql_alert_triage.py:191

This visibility check fails open: --repo 'zopencommunity/privateport/code-scanning/alerts?state=open&ignored=' makes both API requests address the alert-list endpoint, whose list response bypasses this condition. If REPO_GITHUB_TOKEN can read that private repository, its alert details can reach the public job summary or issue comment. Before fetching alerts, require repository metadata whose full_name matches the requested repository and whose private field is explicitly false.

2 resolved since last review

• Use Node.js 22 or later for Copilot CLI
• Reject partial Copilot output after CLI failure

_{Review effort: Balanced}