[maksimtech]

What

The four reads of code scanning alerts in security-posture.yml (open and closed on the ref under review, open and closed on main) go through gh api --paginate --slurp, and the pages are joined into one list. A failed read still fails, so an unreadable list is not taken for an empty one.

Why

The API returns at most a hundred alerts per call, and the gate read only the first page. cookieradar met it on 2026-11-13 (maksimtech/cookieradar#70): a pull request with 123 open alerts and main with 142. Three exceptions whose findings sat past the hundredth read as "matching nothing", and the gate failed on a product whose every alert was explained. Read the other way, an unexplained alert past the hundredth would not have been seen.

This repository had 49 open alerts on main on 2026-11-15, so the gate has not met the limit yet. The fix comes before it does.

How it was checked

• The step and tests/test_security_posture_workflow.py were byte-identical to cookieradar's before its fix, so both are ported unchanged.
• TDD: the three new tests applied alone fail (every read goes through every page, the pages are joined, an API error still reads as an error); with the workflow change, 9 of 9 pass. They run the step's own shell function against a stand-in gh that answers in two pages, and refuse to run if the real gh would be reached.
• ruff clean. In cookieradar the same change, run against the real API, read 123 alerts with verdict ok.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 11 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 17 untouched benchmarks

---

_{Comparing ci/posture-every-page (900a3b5) with main (cca0552)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!