From 766bfafe1bdf2e1970f7363dc0582ebfd39a040a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 13:44:23 +0000
Subject: [PATCH 1/2] Initial plan


From f8181a7660c9c525bb5d0e0a7223041e2260d11d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 25 Jul 2026 13:54:24 +0000
Subject: [PATCH 2/2] Normalize report formatting guidance for security scan
 workflows

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/daily-squid-image-scan.lock.yml | 2 +-
 .github/workflows/daily-squid-image-scan.md       | 7 +++++--
 .github/workflows/daily-vulnhunter-scan.lock.yml  | 2 +-
 .github/workflows/daily-vulnhunter-scan.md        | 4 ++++
 4 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/daily-squid-image-scan.lock.yml b/.github/workflows/daily-squid-image-scan.lock.yml
index 66dfbbbd19c..e11bf91f271 100644
--- a/.github/workflows/daily-squid-image-scan.lock.yml
+++ b/.github/workflows/daily-squid-image-scan.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"03892aaa2365cec0c008bb47f726524ed7d727c4a22a8c47a019d610cdd94589","body_hash":"2191a9e3fc340b103ee2d9e15bee3392965589fac87a008bd2bebead726dc9ae","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.73"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"03892aaa2365cec0c008bb47f726524ed7d727c4a22a8c47a019d610cdd94589","body_hash":"59058b101852747a0b2a4d7c2c21981f8601995adb5b7e03f4a49f33dde096fd","strict":true,"agent_id":"copilot","engine_versions":{"copilot":"1.0.73"}}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.41","digest":"sha256:e39efa0edf10c0d0bfc572b59a186dfccb1973f0f77e224bcf6e5a7d81ee95c8","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.41@sha256:e39efa0edf10c0d0bfc572b59a186dfccb1973f0f77e224bcf6e5a7d81ee95c8"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.41","digest":"sha256:6e2200dcb6a62b183cdcf7ed86e44713ba5ed8eeaf8de143319458898b6e8118","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.41@sha256:6e2200dcb6a62b183cdcf7ed86e44713ba5ed8eeaf8de143319458898b6e8118"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.41","digest":"sha256:cfadaba80ad857ecb6603727296b42d92a9e0ff2f956276c4a46bb35f6f1ac24","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.41@sha256:cfadaba80ad857ecb6603727296b42d92a9e0ff2f956276c4a46bb35f6f1ac24"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.5","digest":"sha256:7550c5132d007266b696d77218e8d1b01f29e6e55520875b2431ef4044df71c9","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.5@sha256:7550c5132d007266b696d77218e8d1b01f29e6e55520875b2431ef4044df71c9"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v1.7.0","digest":"sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308","pinned_image":"ghcr.io/github/github-mcp-server:v1.7.0@sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308"}]}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/daily-squid-image-scan.md b/.github/workflows/daily-squid-image-scan.md
index 36f045622fc..e9329ce7586 100644
--- a/.github/workflows/daily-squid-image-scan.md
+++ b/.github/workflows/daily-squid-image-scan.md
@@ -74,13 +74,16 @@ Review the Syft SBOM, Grype vulnerability, and Grant license scan results in
    the same image are deduplicated. If the scan step failed to produce output,
    create a `Container scan operational failure` issue.
 3. If there are no findings and no operational errors, call `noop`.
-4. In each image issue, include:
+4. Format each image issue with `###` and `####` headings only. Keep a visible
+   `### Summary` section at the top, and wrap verbose per-vulnerability or
+   per-license breakdowns in `<details><summary>...</summary>` blocks.
+5. In each image issue, include:
    - the image name and pinned reference;
    - every vulnerability with severity, CVE ID, package, installed version, and
      fixed versions;
    - every rejected or unknown license and the affected package;
    - actionable remediation guidance.
-5. Keep the report factual and compact. Never omit lower-severity
+6. Keep the report factual and compact. Never omit lower-severity
    vulnerabilities.
 
 The configured `create-issue` safe output is the only allowed write operation.
diff --git a/.github/workflows/daily-vulnhunter-scan.lock.yml b/.github/workflows/daily-vulnhunter-scan.lock.yml
index 975a3458dde..f5b6721d33a 100644
--- a/.github/workflows/daily-vulnhunter-scan.lock.yml
+++ b/.github/workflows/daily-vulnhunter-scan.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a3af665ff17aa80660a3614746ef945aa1f2964c9c16129aace6779df99b2ac7","body_hash":"25bdc06d98c7da8265c15256225306a4fdfdc0c1d8792e15f368bb8ba112517e","strict":true,"agent_id":"claude","agent_model":"claude-sonnet-4.6","engine_versions":{"claude":"2.1.216"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"a3af665ff17aa80660a3614746ef945aa1f2964c9c16129aace6779df99b2ac7","body_hash":"f444be679935b1ad72c2e3c8b3cf7f83b16244550e9e9e036f5d97fa10ac37ca","strict":true,"agent_id":"claude","agent_model":"claude-sonnet-4.6","engine_versions":{"claude":"2.1.216"}}
 # gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"3d3c42e5aac5ba805825da76410c181273ba90b1","version":"v7.0.1"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.41","digest":"sha256:e39efa0edf10c0d0bfc572b59a186dfccb1973f0f77e224bcf6e5a7d81ee95c8","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.41@sha256:e39efa0edf10c0d0bfc572b59a186dfccb1973f0f77e224bcf6e5a7d81ee95c8"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.41","digest":"sha256:6e2200dcb6a62b183cdcf7ed86e44713ba5ed8eeaf8de143319458898b6e8118","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.41@sha256:6e2200dcb6a62b183cdcf7ed86e44713ba5ed8eeaf8de143319458898b6e8118"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.41","digest":"sha256:cfadaba80ad857ecb6603727296b42d92a9e0ff2f956276c4a46bb35f6f1ac24","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.41@sha256:cfadaba80ad857ecb6603727296b42d92a9e0ff2f956276c4a46bb35f6f1ac24"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.5","digest":"sha256:7550c5132d007266b696d77218e8d1b01f29e6e55520875b2431ef4044df71c9","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.5@sha256:7550c5132d007266b696d77218e8d1b01f29e6e55520875b2431ef4044df71c9"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748","pinned_image":"ghcr.io/github/gh-aw-node@sha256:a8082161d7dceda14b68f32eb39d0eaa96b825d07f5895b096afab9d9e0c7748"},{"image":"ghcr.io/github/github-mcp-server:v1.7.0","digest":"sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308","pinned_image":"ghcr.io/github/github-mcp-server:v1.7.0@sha256:c491ffdf6f4c85cb5397021bc655edb8ab825c6f5f568e7597d77a1bd7c4d308"}]}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/daily-vulnhunter-scan.md b/.github/workflows/daily-vulnhunter-scan.md
index 5971328e10c..53f42c55f55 100644
--- a/.github/workflows/daily-vulnhunter-scan.md
+++ b/.github/workflows/daily-vulnhunter-scan.md
@@ -119,6 +119,10 @@ Run Capital One's [VulnHunter](https://github.com/capitalone/VulnHunter) methodo
 
 Use the title `VulnHunter findings in ${{ github.repository }}`.
 
+Structure the issue body with `###` and `####` headings only. Keep the summary
+and highest-confidence findings visible, and wrap supporting evidence or
+per-finding deep dives in `<details><summary>...</summary>` blocks.
+
 For each reported finding include:
 - affected file(s) and function or component
 - vulnerability type and severity
