Release code-scan-action v0.2.2

.release-source.json

@@ -1,7 +1,7 @@
 {
   "repository": "promptfoo/promptfoo",
-  "sourceSha": "e20d258c6c5d005388c0d2e3f187d482b27716b5",
-  "sourceTag": "code-scan-action-0.2.1",
+  "sourceSha": "2041ef9d6ac93637dc363f1f344b955b33f41d5d",
+  "sourceTag": "code-scan-action-0.2.2",
   "packagePath": "code-scan-action",
-  "version": "0.2.1"
+  "version": "0.2.2"
 }

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this package will be documented in this file.
 
+## [0.2.2](https://github.com/promptfoo/promptfoo/compare/code-scan-action-0.2.1...code-scan-action-0.2.2) (2026-10-08)
+
+### Bug Fixes
+
+- **code-scan:** mint OIDC after CLI installation ([#11467](https://github.com/promptfoo/promptfoo/issues/11467)) ([9a404c8](https://github.com/promptfoo/promptfoo/commit/9a404c8ea96e6e8f854964b9224667e704cd405d))
+
 ## [0.2.1](https://github.com/promptfoo/promptfoo/compare/code-scan-action-0.2.0...code-scan-action-0.2.1) (2026-10-06)
 
 ### Bug Fixes

README.md

@@ -23,6 +23,8 @@ To also surface findings in GitHub Code Scanning, configure `sarif-output-path`
 
 Once merged, the scanner will automatically run on future pull requests. Authentication is handled automatically with GitHub OIDC—no API key needed.
 
+The action installs the scanner before requesting its short-lived OIDC token, so slow installs do not expire the token before scanning.
+
 The action runs the scanner with its bundled Node.js 24 runtime. Older action releases and workflow steps that run Promptfoo directly require Node.js `>=22.22.0` on the runner's `PATH`. Configure Node.js 24 LTS for compatibility:
 
 ```yaml

dist/index.js

@@ -33071,7 +33071,7 @@ function getOctokit(token, options, ...additionalPlugins) {
 }
 
 // ../package.json
-var version = "0.124.0";
+var version = "0.124.1";
 
 // ../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -53794,8 +53794,9 @@ async function installPromptfooCli(promptfooVersion) {
   info("\u2705 Promptfoo installed successfully");
   return resolveInstalledPromptfooEntrypoint(installDir);
 }
-async function runPromptfooScan(cliArgs, oidcToken, promptfooVersion) {
+async function runPromptfooScan(cliArgs, promptfooVersion) {
   const promptfooEntrypoint = await installPromptfooCli(promptfooVersion);
+  const oidcToken = await authenticateWithOidc();
   info("\u{1F680} Running promptfoo code-scans run...");
   let scanOutput = "";
   let scanError = "";
@@ -53828,11 +53829,11 @@ ${scanError}`.includes("Fork PR scanning not authorized")) {
   error(`Error output: ${scanError}`);
   throw new Error(`Code scan failed with exit code ${exitCode}`);
 }
-function getScanResponse(cliArgs, oidcToken, promptfooVersion) {
+function getScanResponse(cliArgs, promptfooVersion) {
   if (process.env.ACT === "true") {
     return Promise.resolve(createMockScanResponse());
   }
-  return runPromptfooScan(cliArgs, oidcToken, promptfooVersion);
+  return runPromptfooScan(cliArgs, promptfooVersion);
 }
 function buildCommentBody(comment) {
   let body = formatSeverity(comment.severity) + comment.finding;
@@ -54096,13 +54097,12 @@ async function runCodeScan() {
     return;
   }
   info("\u2705 Not a setup PR - proceeding with security scan");
-  const oidcToken = await authenticateWithOidc();
   const finalConfigPath = resolveConfigPath(inputs.configPath, inputs.minimumSeverity, guidance);
   try {
     const baseBranch = await getBaseBranch(inputs.githubToken, context3);
     await fetchBaseBranch(baseBranch);
     const cliArgs = buildCliArgs(inputs.apiHost, finalConfigPath, baseBranch, context3);
-    const scanResponse = await getScanResponse(cliArgs, oidcToken, inputs.promptfooVersion);
+    const scanResponse = await getScanResponse(cliArgs, inputs.promptfooVersion);
     await handleScanResponse(scanResponse, inputs, context3);
     logActCommentPreview(scanResponse.comments);
   } finally {