Canonical security baseline: paths-exclude / paths-include inputs are broken (v0)

[GSServita]

Summary

In public-reusable-security.yml (Canonical Security Baseline), the paths-exclude / paths-include inputs are defined but broken as of 0.1.0 — passing either one fails both the CodeQL and TruffleHog jobs. Found during the QVAC-21550 Tier-1 rollout; the callers had to drop paths-exclude to get green runs.

Bug 1 — CodeQL config: unquoted globs parsed as YAML aliases

The "Build CodeQL config file" step writes each path as an unquoted YAML list item:

echo "  - $p"

A value starting with * (e.g. **/node_modules/**) is interpreted by the YAML parser as an alias, so codeql-action/init fails:

Cannot parse ".codeql-baseline-config.yml": unidentified alias "*/node_modules/**"

Fix: quote the entries, e.g. printf ' - %s\n' "$p" → emit - "**/node_modules/**" (double-quote the scalar).

Bug 2 — TruffleHog filter file unreadable by the Docker action

The "Materialize path filters" step writes the include/exclude file to the runner host via mktemp (host /tmp), then passes it to trufflesecurity/trufflehog (a Docker action). The container can't see host /tmp:

error trufflehog unable to open filter file {"file":"/tmp/tmp.XXXX","error":"open /tmp/tmp.XXXX: no such file or directory"}
##[error]Process completed with exit code 1

Fix: write the filter file under $GITHUB_WORKSPACE (which the action mounts into the container) and pass the in-container path.

Impact

• Any consumer that sets paths-exclude / paths-include gets a red CodeQL and TruffleHog job.
• Large/native repos can't scope the scan (vendored/third_party/build trees), so they either scan everything or drop the filters (what the rollout did).

Refs

• Rollout: QVAC-21550 (canonical security workflow → Tier-1 repos)
• Surfaced in review on tetherto/qvac-fabric-llm.cpp#177