Copilot CLI , Vorpal, SAST Sarif, authentication issue fixed

.github/workflows/Trivy Scan.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
   workflow_call:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -19,7 +23,9 @@ jobs:
       - name: Build the project
         run: go build -o ./cx ./cmd
       - name: Build Docker image
-        run: docker build -t ast-cli:${{ github.sha }} .
+        env:
+          IMAGE_TAG: ast-cli:${{ github.sha }}
+        run: docker build -t "$IMAGE_TAG" .
       - name: Run Trivy scanner without downloading DBs
         uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 #v0.35.0
         with:

.github/workflows/checkmarx-one-scan.yml

@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   cx-scan:
     name: Checkmarx One Scan

.github/workflows/ci-tests.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
   workflow_call:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -255,8 +259,10 @@ jobs:
 
       - name: Install pre-commit
         if: matrix.needs_precommit == 'true'
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: |
-           pip config set global.index-url https://:${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}@pypi.echohq.com/simple
+           pip config set global.index-url "https://:${ECHO_LIBRARIES_ACCESS_KEY}@pypi.echohq.com/simple"
            pip index versions pre-commit
            pip install pre-commit==4.6.0
 
@@ -282,41 +288,47 @@ jobs:
 
       - name: Run integration tests (${{ matrix.label }})
         if: matrix.name != 'uncovered' || needs.validate-test-coverage.outputs.has_uncovered == 'true'
+        env:
+          MATRIX_NAME: ${{ matrix.name }}
+          MATRIX_LABEL: ${{ matrix.label }}
+          MATRIX_RUN_PATTERN: ${{ matrix.run_pattern }}
+          MATRIX_TIMEOUT: ${{ matrix.timeout }}
+          UNCOVERED_TESTS: ${{ needs.validate-test-coverage.outputs.uncovered_tests }}
         run: |
           set -euo pipefail
 
           # Resolve the -run pattern: catch-all uses Job A output; named groups use matrix field.
-          if [ "${{ matrix.name }}" = "uncovered" ]; then
-            RUN_PATTERN="${{ needs.validate-test-coverage.outputs.uncovered_tests }}"
+          if [ "$MATRIX_NAME" = "uncovered" ]; then
+            RUN_PATTERN="$UNCOVERED_TESTS"
           else
-            RUN_PATTERN="${{ matrix.run_pattern }}"
+            RUN_PATTERN="$MATRIX_RUN_PATTERN"
           fi
 
-          COVER_FILE="cover-${{ matrix.name }}.out"
+          COVER_FILE="cover-${MATRIX_NAME}.out"
 
           run_tests() {
             local pattern="$1" outfile="$2" logfile="$3" timeout_val="$4"
             go test \
               -tags integration \
               -v \
               -timeout "${timeout_val}" \
-              -coverpkg "${{ env.GO_COVERAGE_PKGS }}" \
+              -coverpkg "$GO_COVERAGE_PKGS" \
               -coverprofile "${outfile}" \
               -run "${pattern}" \
               github.com/checkmarx/ast-cli/test/integration 2>&1 | tee "${logfile}" || true
           }
 
-          echo "::group::Attempt 1 — ${{ matrix.label }}"
-          run_tests "$RUN_PATTERN" "$COVER_FILE" "test_output.log" "${{ matrix.timeout }}"
+          echo "::group::Attempt 1 — ${MATRIX_LABEL}"
+          run_tests "$RUN_PATTERN" "$COVER_FILE" "test_output.log" "$MATRIX_TIMEOUT"
           echo "::endgroup::"
 
           FAILED=$(grep -E "^--- FAIL: " test_output.log | awk '{print $3}' | paste -sd '|' - || true)
 
           # ── Retry 1 ──────────────────────────────────────────────────────────
           if [ -n "$FAILED" ]; then
-            echo "::warning::Retry 1 for ${{ matrix.label }}: $FAILED"
-            COVER_R1="cover-${{ matrix.name }}-r1.out"
-            echo "::group::Attempt 2 — ${{ matrix.label }}"
+            echo "::warning::Retry 1 for ${MATRIX_LABEL}: $FAILED"
+            COVER_R1="cover-${MATRIX_NAME}-r1.out"
+            echo "::group::Attempt 2 — ${MATRIX_LABEL}"
             run_tests "$FAILED" "$COVER_R1" "retry1_output.log" "30m"
             echo "::endgroup::"
 
@@ -330,9 +342,9 @@ jobs:
 
             # ── Retry 2 ────────────────────────────────────────────────────────
             if [ -n "$FAILED2" ]; then
-              echo "::warning::Retry 2 for ${{ matrix.label }}: $FAILED2"
-              COVER_R2="cover-${{ matrix.name }}-r2.out"
-              echo "::group::Attempt 3 — ${{ matrix.label }}"
+              echo "::warning::Retry 2 for ${MATRIX_LABEL}: $FAILED2"
+              COVER_R2="cover-${MATRIX_NAME}-r2.out"
+              echo "::group::Attempt 3 — ${MATRIX_LABEL}"
               run_tests "$FAILED2" "$COVER_R2" "retry2_output.log" "30m"
               echo "::endgroup::"
 
@@ -344,13 +356,13 @@ jobs:
 
               FINAL_FAILED=$(grep -E "^--- FAIL: " retry2_output.log | awk '{print $3}' || true)
               if [ -n "$FINAL_FAILED" ]; then
-                echo "::error::Tests still failing after 2 retries in ${{ matrix.label }}: $FINAL_FAILED"
+                echo "::error::Tests still failing after 2 retries in ${MATRIX_LABEL}: $FINAL_FAILED"
                 exit 1
               fi
             fi
           fi
 
-          echo "All ${{ matrix.label }} tests passed."
+          echo "All ${MATRIX_LABEL} tests passed."
 
       - name: Upload coverage artifact
         if: always() && (matrix.name != 'uncovered' || needs.validate-test-coverage.outputs.has_uncovered == 'true')
@@ -392,68 +404,68 @@ jobs:
             echo "failed_list="       >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Send failure notification to Teams
-        if: always() && steps.failed_tests.outputs.has_failures == 'true'
-        uses: Skitionek/notify-microsoft-teams@9c67757f64d610fb6748d8ff3c11f284355ed7ec #v1.0.8
-        with:
-          webhook_url: ${{ secrets.MS_TEAMS_WEBHOOK_URL_INTEGRATION_TESTS }}
-          raw: >
-            {
-              "type": "message",
-              "attachments": [
-                {
-                  "contentType": "application/vnd.microsoft.card.adaptive",
-                  "content": {
-                    "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
-                    "type": "AdaptiveCard",
-                    "version": "1.4",
-                    "msteams": {
-                      "width": "Full"
-                    },
-                    "body": [
-                      {
-                        "type": "TextBlock",
-                        "text": "Integration Tests Failed — ${{ matrix.label }}",
-                        "weight": "Bolder",
-                        "size": "Large",
-                        "color": "Attention"
-                      },
-                      {
-                        "type": "FactSet",
-                        "facts": [
-                          { "title": "Repository:", "value": "${{ github.repository }}" },
-                          { "title": "Author:", "value": "${{ github.actor }}" },
-                          { "title": "Branch:", "value": "${{ github.ref_name }}" },
-                          { "title": "Run ID:", "value": "${{ github.run_id }}" },
-                          { "title": "Group:", "value": "${{ matrix.label }} (${{ matrix.name }})" },
-                          { "title": "Failed Tests:", "value": "${{ steps.failed_tests.outputs.fail_count }}" }
-                        ]
-                      },
-                      {
-                        "type": "TextBlock",
-                        "text": "**Failed Test Cases:**",
-                        "weight": "Bolder",
-                        "spacing": "Medium"
-                      },
-                      {
-                        "type": "TextBlock",
-                        "text": "${{ steps.failed_tests.outputs.failed_list }}",
-                        "wrap": true,
-                        "fontType": "Monospace",
-                        "spacing": "Small"
-                      }
-                    ],
-                    "actions": [
-                      {
-                        "type": "Action.OpenUrl",
-                        "title": "View Workflow Run",
-                        "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-                      }
-                    ]
-                  }
-                }
-              ]
-            }
+      # - name: Send failure notification to Teams
+      #   if: always() && steps.failed_tests.outputs.has_failures == 'true'
+      #   uses: Skitionek/notify-microsoft-teams@9c67757f64d610fb6748d8ff3c11f284355ed7ec #v1.0.8
+      #   with:
+      #     webhook_url: ${{ secrets.MS_TEAMS_WEBHOOK_URL_INTEGRATION_TESTS }}
+      #     raw: >
+      #       {
+      #         "type": "message",
+      #         "attachments": [
+      #           {
+      #             "contentType": "application/vnd.microsoft.card.adaptive",
+      #             "content": {
+      #               "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
+      #               "type": "AdaptiveCard",
+      #               "version": "1.4",
+      #               "msteams": {
+      #                 "width": "Full"
+      #               },
+      #               "body": [
+      #                 {
+      #                   "type": "TextBlock",
+      #                   "text": "Integration Tests Failed — ${{ matrix.label }}",
+      #                   "weight": "Bolder",
+      #                   "size": "Large",
+      #                   "color": "Attention"
+      #                 },
+      #                 {
+      #                   "type": "FactSet",
+      #                   "facts": [
+      #                     { "title": "Repository:", "value": "${{ github.repository }}" },
+      #                     { "title": "Author:", "value": "${{ github.actor }}" },
+      #                     { "title": "Branch:", "value": "${{ github.ref_name }}" },
+      #                     { "title": "Run ID:", "value": "${{ github.run_id }}" },
+      #                     { "title": "Group:", "value": "${{ matrix.label }} (${{ matrix.name }})" },
+      #                     { "title": "Failed Tests:", "value": "${{ steps.failed_tests.outputs.fail_count }}" }
+      #                   ]
+      #                 },
+      #                 {
+      #                   "type": "TextBlock",
+      #                   "text": "**Failed Test Cases:**",
+      #                   "weight": "Bolder",
+      #                   "spacing": "Medium"
+      #                 },
+      #                 {
+      #                   "type": "TextBlock",
+      #                   "text": "${{ steps.failed_tests.outputs.failed_list }}",
+      #                   "wrap": true,
+      #                   "fontType": "Monospace",
+      #                   "spacing": "Small"
+      #                 }
+      #               ],
+      #               "actions": [
+      #                 {
+      #                   "type": "Action.OpenUrl",
+      #                   "title": "View Workflow Run",
+      #                   "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+      #                 }
+      #               ]
+      #             }
+      #           }
+      #         ]
+      #       }
 
       - name: Stop Squid proxy
         if: always()
@@ -537,38 +549,38 @@ jobs:
   # Job D: Write a GitHub Actions Job Summary when any job in the chain fails.
   #        No external service required — everything goes to GITHUB_STEP_SUMMARY.
   # ─────────────────────────────────────────────────────────────────────────────
-  notify-on-failure:
-    name: Notify on Failure
-    needs: [integration-tests, merge-coverage]
-    runs-on: cx-public-ubuntu-x64
-    if: failure()
-    steps:
-      - name: Write failure summary
-        env:
-          INTEGRATION_RESULT: ${{ toJson(needs.integration-tests) }}
-          MERGE_RESULT: ${{ toJson(needs.merge-coverage) }}
-        run: |
-          cat >> "$GITHUB_STEP_SUMMARY" << 'SUMMARY'
-          ## AST-CLI Integration Tests — FAILED
-
-          | Field | Value |
-          |-------|-------|
-          | Run | ${{ github.run_id }} |
-          | Triggered by | ${{ github.event_name }} |
-          | Branch | ${{ github.ref_name }} |
-          | Commit | ${{ github.sha }} |
-          SUMMARY
-
-          printf '\n### integration-tests result\n```json\n%s\n```\n' "$INTEGRATION_RESULT" \
-            >> "$GITHUB_STEP_SUMMARY"
-          printf '\n### merge-coverage result\n```json\n%s\n```\n' "$MERGE_RESULT" \
-            >> "$GITHUB_STEP_SUMMARY"
-
-          cat >> "$GITHUB_STEP_SUMMARY" << 'SUMMARY'
-
-          ### Next Steps
-          1. Click each failed matrix group in the job list above to inspect its logs.
-          2. Download the `test-logs-<group>` artifact for the full `go test` output.
-          3. Retry a specific group manually via **Run workflow** (`workflow_dispatch`).
-          4. If the failure is consistent, open an issue referencing this run.
-          SUMMARY
+  # notify-on-failure:
+  #   name: Notify on Failure
+  #   needs: [integration-tests, merge-coverage]
+  #   runs-on: cx-public-ubuntu-x64
+  #   if: failure()
+  #   steps:
+  #     - name: Write failure summary
+  #       env:
+  #         INTEGRATION_RESULT: ${{ toJson(needs.integration-tests) }}
+  #         MERGE_RESULT: ${{ toJson(needs.merge-coverage) }}
+  #       run: |
+  #         cat >> "$GITHUB_STEP_SUMMARY" << 'SUMMARY'
+  #         ## AST-CLI Integration Tests — FAILED
+
+  #         | Field | Value |
+  #         |-------|-------|
+  #         | Run | ${{ github.run_id }} |
+  #         | Triggered by | ${{ github.event_name }} |
+  #         | Branch | ${{ github.ref_name }} |
+  #         | Commit | ${{ github.sha }} |
+  #         SUMMARY
+
+  #         printf '\n### integration-tests result\n```json\n%s\n```\n' "$INTEGRATION_RESULT" \
+  #           >> "$GITHUB_STEP_SUMMARY"
+  #         printf '\n### merge-coverage result\n```json\n%s\n```\n' "$MERGE_RESULT" \
+  #           >> "$GITHUB_STEP_SUMMARY"
+
+  #         cat >> "$GITHUB_STEP_SUMMARY" << 'SUMMARY'
+
+  #         ### Next Steps
+  #         1. Click each failed matrix group in the job list above to inspect its logs.
+  #         2. Download the `test-logs-<group>` artifact for the full `go test` output.
+  #         3. Retry a specific group manually via **Run workflow** (`workflow_dispatch`).
+  #         4. If the failure is consistent, open an issue referencing this run.
+  #         SUMMARY

.github/workflows/govulncheck.yml

@@ -3,13 +3,16 @@ name: Govulncheck
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
-  govulncheck:
+  govulncheck: # zizmor: ignore[anonymous-definition]
     runs-on: cx-public-ubuntu-x64
-    name: Vulnerability Scan (govulncheck)
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v6

.github/workflows/lint.yml

@@ -3,6 +3,10 @@ name: Lint
 on:
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/nightly-parallel.yml

@@ -17,7 +17,7 @@ permissions:
   contents: read
 
 jobs:
-  integration-tests:
-    name: Run Full Integration Test Suite
+  integration-tests: # zizmor: ignore[anonymous-definition]
     uses: ./.github/workflows/ci-tests.yml
-    secrets: inherit
+    # ci-tests.yml requires ~20 CX/SCM secrets; it's a same-repo reusable workflow, not a fork/third-party target.
+    secrets: inherit # zizmor: ignore[secrets-inherit]