feat(typescript): import GitHub code scanning alerts

[kmbroai]

Summary

Import existing GitHub code scanning alerts into the SDK/CLI for the existing validation workflow, without starting discovery or changing GitHub state.

Changes

• Add importGitHubCodeScanningAlerts() and codex-security import github OWNER/REPO. The default imports open alerts on the default branch; repeat --github-alert NUMBER for exact alerts, use --github-state open|closed|dismissed|fixed|all for lists, or select a reference with --github-ref REF.
• Preserve upstream alert identity, rule/help text, locations, commit/ref, and dismissal context. JSON output can be passed to the existing validate command or validated per alert through the SDK.
• Share the existing GitHub CLI authentication helper with bulk discovery. Retain SDK token authentication, Enterprise hosts, cancellation, and credential-safe errors; add no dependencies.
• Keep focused coverage and concise docs, removing repeated state cases, duplicate validation-flow assertions, and unnecessary test fixture fields.

Testing

• Scoped Bun tests (github.test.ts, bulk-scan-discovery.test.ts, cli.test.ts): 175 passed, 1 platform-specific skip, 0 failed, with umask 022.
• Model generation consistency check, TypeScript type-check, and production TypeScript build: passed.
• Prettier check and git diff --check: passed.
• Built CLI import help and JSON schema: passed.
• API tests use synthetic responses; no live alert import was run. The full suite was not rerun in this pass; CI covers the broader suite and supported platforms.

Risk and rollout

This adds CLI and SDK surface without changing existing command syntax or defaults. Import makes only GitHub GET requests and does not scan, patch, publish verdicts, or mutate alert state. Dependency and secret scanning alerts are outside this scope. Imported alert content remains unvalidated input, and validation must use the intended local checkout. No migration or new dependency is required.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-25T18:00:50.013531Z	2447511	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.