Tracker: security and board automation on a GitHub App credential #2543

Goal

Put the repo's security and board automation on one GitHub App credential, so alerts, advisories and new issues reach board #28 without a maintainer running /issue-triage by hand, and so v2 code is scanned before the release PR rather than on it.

Why now

The v2.9.0 release showed every gap at once:

• CodeQL never scans v2/main. A high-severity ReDoS introduced this milestone (CLI error-envelope URL redaction uses a quadratic regex on server-controlled text (CodeQL, ReDoS) #2540) surfaced only on the milestone-merge PR, and held the release.
• Code-scanning alerts become no issues at all. Three high-severity alerts (Skip the dist/index.js bit #74–Improve Windows Support #76) are open and untracked.
• The Dependabot sweep files issues it cannot board, because the PROJECT_TOKEN it reads has never existed. The SDK watch and the monthly refresh never board by design, for the same reason.
• GHSA draft cards and nightly triage were both parked as blocked on the same credential, with no card of their own for the credential.

Structure

Everything that writes to the board waits on one prerequisite: the GitHub App. Two items need no credential and can start immediately.

The Sub-issues panel on this issue is the canonical list. Order of work:

1. Unblocked, start now: CodeQL on v2/main, and fixing alerts Skip the dist/index.js bit #74–Improve Windows Support #76.
2. The prerequisite: create the GitHub App (an org-admin act; human-gated).
3. Then, in any order: move the Dependabot sweep onto the App, the code-scanning sweep (Nightly security sweep: turn Dependabot and code-scanning (CodeQL) alerts into board-tracked issues #2542), GHSA draft cards (GHSA draft cards: place on the board for the affected line, and include affected versions + reporter #2462), nightly triage (Nightly triage: sweep unboarded issues onto the board and run the board audit #2463), and boarding for the SDK watch and monthly refresh.

Invariants every sub-issue keeps

These are from AGENTS.md:

• No model runs in a write-capable job. The deterministic sweeps need no model. Nightly triage (Nightly triage: sweep unboarded issues onto the board and run the board audit #2463) does, and must use the three-job shape sdk-watch.yml established.
• A marker is trusted only on automation-authored issues, because the repo is public.
• Every action in a credentialed job is SHA-pinned (verify:action-pins).
• A sweep that cannot read its listing fails loudly and writes nothing.
• Accepting and publishing a security advisory stay human-gated; automation only creates tracking cards.

Done when

Every sub-issue is closed, and a nightly run boards what it files with no manual step.