build(deps): bump rsdmike/github-security-report-action from 3.0.4 to 4.0.1

[dependabot]

Bumps rsdmike/github-security-report-action from 3.0.4 to 4.0.1.

Release notes

Sourced from rsdmike/github-security-report-action's releases.

v4.0.1

A maintenance release. The action runtime is unchanged from v4.0.0 (using: node24), so this is a drop-in upgrade for existing workflows — the internals moved to ESM, but that is invisible to consumers, who only ever run the bundled dist/index.js.

The one thing that does change is the rendered output of the report template, which is the point of two of the fixes below.

Fixed

SARIF rule help now renders as HTML in the report template. marked was imported and configured but never actually invoked — the DOMPurify sanitizer was being passed to nunjucks-markdown as the renderer — so rule help text appeared in the generated HTML and PDF as literal markdown source (# Heading, **bold**, [link](https://github.com/rsdmike/github-security-report-action/blob/HEAD/url)). It is now parsed with marked and then sanitized, as originally intended. Untrusted SARIF content is still scrubbed.

The bundled templates are no longer shipped stale. dist/templates/ in v4.0.0 had drifted from templates/, so the report output was missing the per-alert Tool: row and a page break before the Dependency Vulnerabilities section. npm run package now copies the templates explicitly rather than relying on ncc's asset relocator, which only recognises path.join(__dirname, '…') and silently stopped copying anything once the sources moved to import.meta.dirname. npm run test:dist now fails if dist/templates ever drifts from source again, or if a bundled template stops compiling.

Changed

• Migrated from CommonJS to ESM, using Node's native TypeScript type stripping instead of ts-node.
• Dropped nunjucks-markdown (unmaintained, last published June 2022) in favour of a native nunjucks filter. Output is identical for the same input, and the filter renders empty rather than throwing when a rule carries no help markdown.
• Dependency updates: @actions/core and @actions/io v3, @octokit/rest v22, @octokit/types v17, marked v18.
• The minimum Node version for running the CLI from a clone is now 22.18.0 (was 22.12.0). This does not affect the action itself — the runner supplies the node24 runtime.

Documentation

• Removed report_sca from the list of available templates. It has never existed in any release, and passing it fails with Failed to resolve a template file. Software Composition Analysis is already part of report.
• Documented aggregated_report, which does exist: the same content as report, with open code scanning alerts grouped by rule and an instance count per rule, rather than listed individually.

Verification

Each top-level template was rendered against the committed sample payload, and the packaged action was run end-to-end on a real repository — CodeQL analyze into ../results, then template: report — producing a valid 281 KB PDF.

Full changelog: rsdmike/github-security-report-action@v4.0.0...v4.0.1

v4.0.0

⚠️ Breaking changes

The action now runs on the node24 runtime and requires Node >= 22.12.0.

action.yml moves from using: node16 to using: node24. node16 is end-of-life, and puppeteer-core 25 requires Node >= 22.12.0, so node20 was no longer viable either.

Before upgrading, check that:

• Self-hosted runners are on a runner release that supports the node24 runtime. Older runners will fail to start the action.
• Linux self-hosted runners have glibc 2.28 or newer. Node 24 binaries will not run on older glibc (RHEL/CentOS 7 and Ubuntu 18.04 are below this).

GitHub-hosted runners already satisfy both.

Features

• Add Trivy results to the scan (#544ffd6)

... (truncated)

Commits

• 1df22b1 chore(release): v4.0.1
• 56798d0 fix(build): copy templates into dist/ instead of relying on ncc
• ae714b0 test: add a smoke test that the packaged bundle loads
• 719cb10 refactor(templating): drop nunjucks-markdown for a native nunjucks filter
• 766cb29 fix(templating): render markdown via marked and bump marked to v18
• 3fea622 build(deps): update @​octokit/rest to v22 and @​octokit/types to v17
• 2ad83c0 build(deps): update @​actions/core and @​actions/io to v3
• 902fba0 build: migrate from CommonJS to ESM
• 6d3e62d docs: replace standalone-executable instructions with CLI usage
• d667152 ci: exclude dist/ from CodeQL analysis
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)