ci: bump security report action to v4.1.0 and surface its failures

[rsdmike]

Why

The Generate Security Report step in this workflow has been failing and producing no PDF:

##[error]Request failed due to following response errors:
 - timedout
mv: cannot stat 'report.pdf': No such file or directory

This was invisible because the step carries continue-on-error: true — the CodeQL job stayed green and GitHub's API reported the step's conclusion as success, since continue-on-error rewrites it. The failure existed only in the raw logs.

Root cause was in the action: it expanded dependencyGraphManifests.dependencies over GraphQL, which makes GitHub resolve every manifest's full dependency graph. A large lockfile exceeds the server-side budget and times out. Fixed in rsdmike/github-security-report-action#274, released as v4.1.0.

Changes

• Bump rsdmike/github-security-report-action from v3.0.4 to v4.1.0 (a3d8cc0, verified to match the v4.1.0 tag).
• Drop continue-on-error: true from that step so failures fail the job.
• Gate the step to non-fork events. SECURITY_TOKEN is not exposed to fork PRs, and the action reads it via core.getInput('token', { required: true }), which throws Input required and not supplied: token on an empty value. Without the guard, removing the suppression would fail the whole CodeQL job on external contributions.

Verification

This exact change was verified end to end in ui-toolkit-angular#2578: the report step went from failing in 5.4s with no output, to succeeding in 12s and uploading a 132KB PDF artifact — with the guard confirmed not to skip the step on same-repo PRs.

The CodeQL run on this PR exercises it here.

Notes

• continue-on-error is deliberately left on Rename Report and Upload Artifacts; those are unreachable if the report step fails now.
• I have not separately confirmed this repo's logs showed the same timedout error — the fix and the suppression removal are correct regardless, and this PR's own CodeQL run will demonstrate it.

Supersedes

This replaces two open PRs that make the identical v3.0.4 → v4.0.1 change, which v4.1.0 subsumes:

• ci: update to latest codeql reporter #2143 ci/update-codeql-reporter-v4.0.1
• build(deps): bump rsdmike/github-security-report-action from 3.0.4 to 4.0.1 #2149 (dependabot)

Both can be closed if this lands.

Note on the major-version jump: v4.0.0 moved the action to the node24 runtime, requiring Node >= 22.12.0 and glibc 2.28+ on self-hosted Linux runners. This workflow runs on ubuntu-latest, which satisfies both.

https://claude.ai/code/session_017rtnF1RVUGPNwD6f7EL8cB

[Copilot]

Pull request overview

Updates the CodeQL workflow’s “Generate Security Report” step to a newer pinned version of rsdmike/github-security-report-action, and makes failures visible by no longer suppressing errors—while adding a guard to avoid running on fork PR events where the required secret isn’t available.

Changes:

• Bump rsdmike/github-security-report-action from v3.0.4 to v4.1.0 (pinned by SHA).
• Remove continue-on-error: true from “Generate Security Report” so the job fails when report generation fails.
• Add an if: guard to skip report generation on fork PRs where secrets.SECURITY_TOKEN is not provided.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.