scan-and-report.yml: "Build the commit under test" builds the caller, so every external caller dies at "Run scan" (exit 127) #276

Symptom

Every repository that calls scan-and-report.yml as a reusable workflow fails at Run scan:

./target/release/panic-attack: No such file or directory
##[error]Process completed with exit code 127.

Observed on hyperpolymath/echidna main: Security Scan run 42351376316, calling scan-and-report.yml@be6ac46.

Root cause

#242 (df96e43, 2026-10-25) answered #212 by replacing cargo install --git … --branch main with:

- uses: actions/checkout@3d3c42e… # v7.0.1        # no `repository:`
- name: Build the commit under test
  run: cargo build --locked --release
- name: Run scan
  run: ./target/release/panic-attack assail …

Inside a reusable workflow, actions/checkout without repository: checks out the caller. So cargo build builds the caller's crate, echidna in this case, and no panic-attack binary is ever produced.

The step works only when panic-attack calls itself. That is presumably the only place it was exercised.

Proposed fix

Keep the #212 property, building the pinned scanner and never main, by building panic-attack from the reusable's own commit:

- uses: actions/checkout@3d3c42e… # v7.0.1        # caller: the scan target
- uses: actions/checkout@3d3c42e… # v7.0.1        # scanner source at this reusable's commit
  with:
    repository: hyperpolymath/panic-attack
    ref: ${{ job.workflow_sha }}
    path: .panic-attack-src
    persist-credentials: false
- name: Build the scanner at the pinned commit
  run: cargo build --locked --release --manifest-path .panic-attack-src/Cargo.toml
- name: Run scan
  run: .panic-attack-src/target/release/panic-attack assail ${{ inputs.repo_path }} --output scan-result.json

• job.workflow_sha is the commit of the called workflow, so a caller pinning @<sha> gets exactly that scanner.
• The scan step should exclude .panic-attack-src from the target. Either check it out outside $GITHUB_WORKSPACE, or delete it before scanning, as standards' secret scanner does with its tooling checkout.

Acceptance criteria

• An external caller (e.g. echidna's security-scan.yml) reaches Run scan, and the binary exists.
• panic-attack's own self-call still builds the commit under test.
• The scan report contains no findings from .panic-attack-src.

Refs #212.