ci: allow security scan workflow to target a single branch

Add a 'branch' input to workflow_dispatch that allows scanning a specific
branch (e.g. fix/override-shell-quote-1.0) without auto-discovering all
version branches. This enables verifying fix branches pass the security
scan before creating PRs.

Usage: gh workflow run "Security Scan" --ref main -f branch=fix/my-branch -f standalone-run=true

Author: azmkercso

.github/workflows/security-scan.yaml

@@ -22,6 +22,11 @@ on:
         required: false
         type: boolean
         default: false
+      branch:
+        description: 'Single branch to scan (e.g. fix/override-shell-quote-1.0). If empty, scans all version branches.'
+        required: false
+        type: string
+        default: ''
 
 env:
   CODE_EDITOR_TARGETS: '["code-editor-sagemaker-server"]'
@@ -31,12 +36,21 @@ jobs:
   get-branches-to-scan:
     runs-on: ubuntu-latest
     outputs:
-      security-scan-branches: ${{ steps.determine-pr-branches.outputs.branches || steps.determine-scheduled-security-scan-branches.outputs.branches }}
-      global-dependencies-branches: ${{ steps.determine-pr-branches.outputs.branches || steps.determine-scheduled-global-dependencies-branches.outputs.branches }}
-      output-branch-name: ${{ steps.determine-pr-branches.outputs.output-branch-name || steps.get-upstream-branches.outputs.output-branch-name }}
+      security-scan-branches: ${{ steps.manual-branch.outputs.branches || steps.determine-pr-branches.outputs.branches || steps.determine-scheduled-security-scan-branches.outputs.branches }}
+      global-dependencies-branches: ${{ steps.manual-branch.outputs.branches || steps.determine-pr-branches.outputs.branches || steps.determine-scheduled-global-dependencies-branches.outputs.branches }}
+      output-branch-name: ${{ steps.manual-branch.outputs.output-branch-name || steps.determine-pr-branches.outputs.output-branch-name || steps.get-upstream-branches.outputs.output-branch-name }}
     steps:
+      - name: Use manually specified branch
+        id: manual-branch
+        if: github.event_name == 'workflow_dispatch' && inputs.branch != ''
+        run: |
+          echo "Manual branch specified: ${{ inputs.branch }}"
+          echo 'branches=["${{ inputs.branch }}"]' >> "$GITHUB_OUTPUT"
+          echo "output-branch-name=${{ inputs.branch }}" >> "$GITHUB_OUTPUT"
+
       - name: Checkout repository
         uses: actions/checkout@v6
+        if: steps.manual-branch.outputs.branches == ''
         with:
           fetch-depth: 0
 
@@ -63,7 +77,7 @@ jobs:
 
       - name: Get all upstream branches
         id: get-upstream-branches
-        if: github.event_name != 'push'
+        if: github.event_name != 'push' && steps.manual-branch.outputs.branches == ''
         run: |
           # Get main branch and all version branches (*.*)
           branches=$(git branch -r | grep -E 'origin/(main|[0-9]+\.[0-9]+)$' | sed 's/origin\///' | tr '\n' ' ')
@@ -73,7 +87,7 @@ jobs:
 
       - name: Get completed workflows from previous day
         id: get-completed-workflows
-        if: github.event_name != 'push'
+        if: github.event_name != 'push' && steps.manual-branch.outputs.branches == ''
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -97,7 +111,7 @@ jobs:
 
       - name: Check for successful scan artifacts from previous day
         id: check-scan-artifacts
-        if: github.event_name != 'push'
+        if: github.event_name != 'push' && steps.manual-branch.outputs.branches == ''
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPOSITORY: ${{ github.repository }}
@@ -148,7 +162,7 @@ jobs:
 
       - name: Determine security scan branches for scheduled runs
         id: determine-scheduled-security-scan-branches
-        if: github.event_name != 'push'
+        if: github.event_name != 'push' && steps.manual-branch.outputs.branches == ''
         run: |
           upstream_branches="${{ steps.get-upstream-branches.outputs.upstream-branches }}"
           successful_branches="${{ steps.check-scan-artifacts.outputs.successful-security-scan-branches }}"
@@ -185,7 +199,7 @@ jobs:
 
       - name: Determine global dependencies branches for scheduled runs
         id: determine-scheduled-global-dependencies-branches
-        if: github.event_name != 'push'
+        if: github.event_name != 'push' && steps.manual-branch.outputs.branches == ''
         run: |
           upstream_branches="${{ steps.get-upstream-branches.outputs.upstream-branches }}"
           successful_branches="${{ steps.check-scan-artifacts.outputs.successful-global-dependencies-branches }}"