ci: bump security report action to v4.1.0 and surface its failures

[rsdmike]

Why

The Generate Security Report step in this workflow has been failing and producing no PDF:

##[error]Request failed due to following response errors:
 - timedout
mv: cannot stat 'report.pdf': No such file or directory

This was invisible because the step carries continue-on-error: true — the CodeQL job stayed green and GitHub's API reported the step's conclusion as success, since continue-on-error rewrites it. The failure existed only in the raw logs.

Root cause was in the action: it expanded dependencyGraphManifests.dependencies over GraphQL, which makes GitHub resolve every manifest's full dependency graph. A large lockfile exceeds the server-side budget and times out. Fixed in rsdmike/github-security-report-action#274, released as v4.1.0.

Changes

• Bump rsdmike/github-security-report-action from v4.0.1 to v4.1.0 (a3d8cc0, verified to match the v4.1.0 tag).
• Drop continue-on-error: true from that step so failures fail the job.
• Gate the step to non-fork events. SECURITY_TOKEN is not exposed to fork PRs, and the action reads it via core.getInput('token', { required: true }), which throws Input required and not supplied: token on an empty value. Without the guard, removing the suppression would fail the whole CodeQL job on external contributions.

Verification

This exact change was verified end to end in ui-toolkit-angular#2578: the report step went from failing in 5.4s with no output, to succeeding in 12s and uploading a 132KB PDF artifact — with the guard confirmed not to skip the step on same-repo PRs.

The CodeQL run on this PR exercises it here.

Notes

• continue-on-error is deliberately left on Rename Report and Upload Artifacts; those are unreachable if the report step fails now.
• I have not separately confirmed this repo's logs showed the same timedout error — the fix and the suppression removal are correct regardless, and this PR's own CodeQL run will demonstrate it.

https://claude.ai/code/session_017rtnF1RVUGPNwD6f7EL8cB

[Copilot]

Pull request overview

Updates the CodeQL workflow’s “Generate Security Report” step to use a newer pinned version of rsdmike/github-security-report-action, and changes CI behavior so report-generation failures are no longer silently ignored while still avoiding failures on fork PRs where the required secret is unavailable.

Changes:

• Bump rsdmike/github-security-report-action from v4.0.1 to v4.1.0 (pinned SHA).
• Remove continue-on-error: true from the security report generation step so real failures fail the job.
• Add an if: guard so the step is skipped on fork PRs where secrets.SECURITY_TOKEN is not available.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.