Split Github Vulnerability Scan into separate SCA & SAST parsers

[Logicmn]

Description

Hello! The current parser implementation for GitHub code scanning results is baked into the "Github Vulnerability Scan" scan type, which is a parser originally meant to be used for GitHub SCA (Dependabot) vulnerabilities. Since these two scan types are exceptionally different, issues can arise especially around the fields used for deduplication in the hash code. This PR splits out GitHub code scanning into its own GithubSASTParser, with a scan-type string called ""Github SAST Scan." I have included documentation, unit tests, and a new list of fields for hash code deduplication.

I also included several improvements for the original Github Vulnerability Scan parser. These improvements include:

• Add support for the cvssSeverities which will replace the cvss field in GitHub's graphql response in October, 2025.
• Add the permalink from the dependabotUpdate field to the finding description
• Add GitHub's now supported epss percentage and percentile to finding.epss_score and finding.epss_percentile finding fields
• Set finding.url to GitHub Dependabot alert hyperlink for convenience
• Improve vulnerability ID handling (now explicitly sets finding.cve and finding.vuln_id_from_tool fields before falling back to unsaved_vulnerability_ids)
• Fix a bug where finding.component_version was only being set when the vulnerableRequirements str started with =
• Improve defensive coding where applicable, like using .get() to access fields

Backward compatibility: existing users of the “Github Vulnerability Scan” scan type (driven by GithubVulnerabilityParser) for SCA imports will see no change. If you’d been using it to ingest SAST/code-scanning JSON, you’ll need to switch your import to the new “Github SAST Scan” scan type (driven by GithubSASTParser).

Ref links:

• Original impl of GitHub code scanning support: Fix github parser issue 9582 #9583
• GitHub code scanning API reference: https://docs.github.com/en/rest/code-scanning/code-scanning

[Logicmn]

@Maffooch All linting errors should be fixed now, thanks for bearing with. :)

[valentijnscholten]

comment posted above

[dogboat]

Just two nits about import placement, but otherwise looks great; approving because they're not blockers imho.

[Logicmn]

comment posted above

Responded

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

Approved