feat: import GitHub code scanning and GHSA advisories to Cloud

[mldangelo-oai]

Summary

Stacked on #1441. Bring saved GitHub code-scanning alerts and separately selected GHSA advisories into the existing Cloud finding-import workflow. The SDK now exposes the same preview and explicit publication boundary as the CLI.

Changes

• Keep import github OWNER/REPO compatible and map its selected-ref evidence for publish findings FILE --provider github.
• Add import github-advisories OWNER/REPO, defaulting to published repository advisories. Explicit GHSA IDs support repository or global advisory lookup; global lookup never enumerates the database.
• Preserve source identities, original JSON, source status, affected ranges, and unknown severity. Advisory records do not claim that a vulnerable package is installed, and imported evidence remains not assessed by Codex.
• Reuse immutable request batching, saved receipts, interrupted-upload recovery, and repository checks. Export the publication APIs and types for SDK consumers, with CLI, plugin, and SDK documentation.

Testing

Validation at b4574941, integrated with the updated #1441 parent:

• 255 focused GitHub/GHSA/Wiz mapping, publication, and retry tests passed with 8,080 assertions. TypeScript/model freshness and formatting passed.
• Pinned Python lint/format, SDK build, portable source compatibility, and all 9 portable-source tests passed.
• The packed SDK and installed-package smoke checks passed (634 package entries), including CLI, public imports, NodeNext types, detached plugin, and nested worker execution.
• Both full suite orders completed (seeds 12345 and 1907551529): each had 5,156 passes, 75 skips, and the same one pre-existing installed-hook test failure reproduced on unchanged main. The suites are not fully green locally; security-installed hooks remained enabled.
• Three independent native reviews and separate verification found no actionable issues.
• Public global-advisory responses from GitHub API versions 2022-11-28 and 2026-03-10 preserved all reported patch versions and original evidence through the built mapper. The string/null field matches GitHub's REST contract.
• A live, read-only public global-advisory retrieval through the SDK also preserved all reported patch versions and original evidence.
• Hosted CI must qualify this commit before merge. Cloud import, retention/readback, and deployment were not exercised.

Risk and rollout

Requires the corresponding Cloud contract support for GitHub, advisory evidence, and unknown imported severity before use. Existing Wiz evidence serialization and retry compatibility are preserved. This adds read-only GitHub retrieval and explicit Cloud publication; it does not write back to GitHub or start an assessment.

This follow-on targets the Wiz publisher branch and depends on #1441 landing first.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T06:48:06.084803Z	b457494	New commits
🔒 Security Review	✅ Completed 2026-10-17T06:48:44.513994Z	b457494	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Reviewed the actual diff against #1441 at 9351529f6dfa9e61ae86fcbe8d678d041e2e3932 in three independent passes, including the advisory mapping, pagination, publication tests, and public API documentation. Explicit advisory selection, repository/source identity, dismissal state, failed-page handling, and original evidence preservation are consistent across the SDK and CLI.

No additional blocking findings in this diff. This depends on #1441, whose outstanding concurrent-publication finding remains relevant before the stack is merged. Static review only; no live GitHub/Cloud calls, build, or integration suite run.

[alandelong-oai]

Correction to the condition in my approval: I have withdrawn the identical-concurrent-publication finding on #1441 and approved that parent PR. My approval of this diff at 9351529f6dfa9e61ae86fcbe8d678d041e2e3932 no longer carries that condition. This remains a static review; no live integration tests run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 59949f66e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Read the nested global patched-version identifier

For advisories returned by GitHub's global advisory endpoint, first_patched_version is an object such as { "identifier": "1.2.3" }, not a string. Passing that object to text() always returns null, so every global advisory silently publishes an empty fixed_versions array even when GitHub supplies a patch, undermining the promised preservation of patched versions. Read first_patched_version.identifier and update the synthetic fixture to use the real API shape.

AGENTS.md reference: sdk/typescript/AGENTS.md:L35-L38

Useful? React with 👍 / 👎.