ci: after a release, rerun the failed binary scan in place

.github/workflows/main-binary-scan.yaml

@@ -10,13 +10,7 @@ on:
     branches: [ 'main' ]
   schedule:
     - cron: '23 5 * * 1' # weekly, so new advisories against unchanged binaries still turn main red
-  # rescan once a release has published, so shipping the fix clears the red rather than the next commit.
-  # workflow_run is flagged as dangerous because it can hand secrets to a run triggered by untrusted code;
-  # here it only reacts to the tag-triggered release workflow, checks out main and has read-only permissions
-  workflow_run:  # zizmor: ignore[dangerous-triggers]
-    workflows: ['Release']
-    types: ['completed']
-  workflow_dispatch:
+  workflow_dispatch: # release.yaml reruns the failed jobs of the latest run on main once a release publishes
 
 permissions:
   contents: read
@@ -25,8 +19,6 @@ jobs:
   release:
     name: release binary
     runs-on: ubuntu-latest
-    # after a release, only scan if it actually published
-    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -54,8 +46,6 @@ jobs:
   main:
     name: build of main
     runs-on: ubuntu-latest
-    # after a release, only scan if it actually published
-    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/release.yaml

@@ -63,3 +63,24 @@ jobs:
           TAG: ${{ github.ref_name }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
         run: ./scripts/update-homebrew-formula.sh
+
+  # the binary scan (main-binary-scan.yaml) goes red on main when the published release has a known
+  # vulnerability, and only a release can clear it. rerun the failed jobs of the scan runs on main's head so
+  # the red check runs are replaced in place; a fresh run from a new event would sit beside them and the
+  # commit would stay red
+  rescan:
+    needs: goreleaser
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write # rerun workflow jobs
+    steps:
+      - name: rerun the failed binary scan jobs on main
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          head=$(gh api "repos/$GH_REPO/commits/main" --jq .sha)
+          runs=$(gh run list -w main-binary-scan.yaml -c "$head" --json databaseId,conclusion \
+            --jq '.[] | select(.conclusion == "failure") | .databaseId')
+          if [ -z "$runs" ]; then echo "no failed binary scan on main ($head), nothing to rerun"; exit 0; fi
+          for run in $runs; do echo "rerunning failed jobs of $run"; gh run rerun "$run" --failed; done