fix: update security workflow

[Vui-Chee]

Description

Fixes and hardens the security-dependabot-fix workflow so it reliably detects, deduplicates, and auto-patches Dependabot security alerts without creating duplicate PRs.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Changes

Fix: use gh CLI instead of github-script for alert fetching

The github-script REST client was silently swallowing API errors (e.g. auth/permission failures), leaving has_alerts=false and skipping all downstream steps with no visible error. Switching to the gh CLI means failures exit loudly with a clear message.

Fix: Dependabot alerts API requires a fine-grained PAT

GITHUB_TOKEN returns 404 on the Dependabot alerts endpoint regardless of the security-events: read permission — GitHub maps that scope to code scanning, not Dependabot. A fine-grained PAT (GH_SECURITY_PAT) with "Dependabot alerts: Read" is required. Raw JSON is now fetched to a file first so a gh api error is caught before jq runs (fixes the Cannot index string error that followed the 404).

Fix: avoid GH_TOKEN collision with the runner pre-set value

GitHub Actions runners automatically set GH_TOKEN=GITHUB_TOKEN for the gh CLI before any step runs. Setting GH_TOKEN in the step env block with the PAT was silently overridden by the runner. Fix: store the PAT as a distinctly-named env var (GH_SECURITY_PAT) and apply it inline (GH_TOKEN="$GH_SECURITY_PAT" gh api ...) so the shell-level assignment wins.

Fix: gh pr list used the wrong token for deduplication

The existing-PR check (gh pr list) ran under GH_SECURITY_PAT, which only has "Dependabot alerts: Read" and cannot list pull requests. The command failed silently (2>/dev/null || echo '[]'), making every alert appear unhandled on every run. Fix: use GITHUB_TOKEN (which has pull-requests: write) for the PR list call.

Fix: deduplicate by package name, not alert number

The original filter extracted the alert number from the branch name (split("-") | last) and matched it against each alert's .number. A single package can have multiple CVE alerts, and a single PR can fix all of them under one branch named after the first alert. Subsequent alerts for the same package were never matched and triggered duplicate PRs. Fix: match by package name — skip any alert whose package already has an open fix/security-<package>-* branch.

Fix: use dynamic default branch

Replaced the hardcoded main reference with ${{ github.event.repository.default_branch }} so the workflow works on repos whose default branch is not named main.

Fix: correct allowedTools parameter for claude-code-action

allowed_tools is not a valid input for claude-code-action; the correct form is claude_args: "--allowedTools Bash,Read,Write,Edit,Glob,Grep". The invalid key was silently ignored, leaving Claude with no tool permissions and causing repeated permission denials.

Refactor: pre-select alerts in jq before Claude runs

Filter to critical/high/medium severity, sort by severity rank, check for existing PRs, and write the final top-2 list to /tmp/alerts.json before Claude is invoked. This removes all in-prompt budget logic, keeps the Claude prompt focused on fixing, and prevents prompt injection (advisory text is written to a file, never interpolated into the prompt).

Checklist

• I have reviewed the relevant code guidelines in the docs/ folder
• My code follows the coding standards of this project
• I have performed a self-review of my own code