fix(security): use supported OSV output-file flag

.github/workflows/security-scan.yml

@@ -81,7 +81,7 @@ jobs:
         with:
           scan-args: |
             --format=json
-            --output=old-results.json
+            --output-file=old-results.json
             --maven-registry=https://maven-central.storage-download.googleapis.com/maven2
             --no-resolve
             --allow-no-lockfiles
@@ -99,7 +99,7 @@ jobs:
         with:
           scan-args: |
             --format=json
-            --output=old-results.json
+            --output-file=old-results.json
             --no-resolve
             --allow-no-lockfiles
             -r
@@ -120,7 +120,7 @@ jobs:
         with:
           scan-args: |
             --format=json
-            --output=new-results.json
+            --output-file=new-results.json
             --maven-registry=https://maven-central.storage-download.googleapis.com/maven2
             --no-resolve
             --allow-no-lockfiles
@@ -138,7 +138,7 @@ jobs:
         with:
           scan-args: |
             --format=json
-            --output=new-results.json
+            --output-file=new-results.json
             --no-resolve
             --allow-no-lockfiles
             -r
@@ -191,7 +191,7 @@ jobs:
         uses: google/osv-scanner-action/osv-reporter-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8
         with:
           scan-args: |
-            --output=results.sarif
+            --output-file=results.sarif
             --old=old-results.json
             --new=new-results.json
             --gh-annotations=true

CHANGELOG.md

@@ -36,6 +36,9 @@ Semantic Versioning where the repository publishes a release.
 
 ### Fixed
 
+- Fixed the central OSV v2.3.8 security gate and reporter to use the supported
+  `--output-file` option, preserving the required base/head result documents
+  instead of failing the gate at its output-presence check.
 - Refused PR Review Merge Scheduler head mutations, `update-branch` and the last-push approval head restamp, whenever the resolved mutation credential is the workflow `GITHUB_TOKEN`. GitHub starts no workflow run for events created with that credential, so the moved head collected no current-head required checks and the PR stayed permanently `BLOCKED` with a `github-actions[bot]` merge commit that no later scheduler run could repair, because the branch was no longer behind. The scheduler now waits with `head_mutation_credential_upgrade` guidance naming `PR_REVIEW_MERGE_TOKEN`, `OPENCODE_APPROVE_TOKEN`, and the OpenCode app token exchange.
 - Parsed `opencode.jsonc` as JSONC (stripping `//` and `/* */` comments outside string literals) in the reasoning-effort guard and its contract tests, instead of raw `json.loads`, which rejected the file the moment it carried its first explanatory comment (added for the `contextual-orchestrator` provider block) with `Expecting property name enclosed in double quotes`. Comment markers inside string values, such as the `$schema` URL, are left untouched.
 - Download the pinned `uv` 0.12.1 exporter from the official GitHub Releases URL instead of `releases.astral.sh`, which now returns HTTP 403 and blocks org-wide OpenCode `coverage-evidence`. The SHA-256 pin is unchanged. The opener may follow one hop onto `release-assets.githubusercontent.com` or `objects.githubusercontent.com` and still rejects every other host, userinfo, non-HTTPS scheme, and nondefault port (ContextualWisdomLab/.github#1109).

tests/test_required_workflow_queue_contract.py

@@ -908,8 +908,10 @@ def test_security_scan_allows_repositories_without_supported_lockfiles() -> None
     workflow = workflow_text("security-scan.yml")
 
     assert workflow.count("--allow-no-lockfiles") == 4
-    assert "--output=old-results.json" in workflow
-    assert "--output=new-results.json" in workflow
+    assert "--output-file=old-results.json" in workflow
+    assert "--output-file=new-results.json" in workflow
+    assert "--output=old-results.json" not in workflow
+    assert "--output=new-results.json" not in workflow
     assert "test -s old-results.json" in workflow
     assert "test -s new-results.json" in workflow
 
@@ -983,8 +985,10 @@ def test_osv_scan_logs_and_retries_without_transitive_resolution_on_resolver_fai
         "Retry head OSV without transitive resolution\n        if: steps.osv_head.outcome == 'failure'\n        continue-on-error: true"
         in workflow
     )
-    assert "--output=old-results.json" in workflow
-    assert "--output=new-results.json" in workflow
+    assert "--output-file=old-results.json" in workflow
+    assert "--output-file=new-results.json" in workflow
+    assert "--output=old-results.json" not in workflow
+    assert "--output=new-results.json" not in workflow
     assert "Print OSV findings being compared" in workflow
     assert "OSV {label} scan produced {len(findings)} finding(s)" in workflow