Bearer-CLI reusable workflows

[dockscp]

Adds reusable Bearer-CLI security scanning for organization repositories:

• Differential PR scans and manual full scans.
• Reports findings through native annotations and job summaries.
• Caller templates, configuration defaults and setup/suppression docs.
• Semgrep triage guidance.

[Copilot]

🟡 Changes recommended

Both reusable workflows have critical checkout failures, and the differential summary has a moderate Markdown-injection risk.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds reusable Bearer-CLI security scanning for pull requests and manual full scans, with annotations, summaries, templates, configuration, and documentation.

Changes:

• Adds differential and full-scan workflows with severity and enforcement controls.
• Adds reporting, annotations, configuration, and suppression templates.
• Adds Bearer-CLI setup and Semgrep guidance.

File summaries

File	Description
SEMGREP.md	Semgrep triage guidance
README.md	Toolkit guide index
bearer/templates/.github/workflows/bearer-pr.yml	Pull-request caller template
bearer/templates/.github/workflows/bearer-full.yml	Manual full-scan caller template
bearer/templates/.bearer/bearer.yml	Bearer configuration template
bearer/templates/.bearer/bearer.ignore	Ignore-file template
bearer/scripts/bearer-summary.mjs	Report rendering and annotations
bearer/README.md	Bearer setup and usage documentation
.github/workflows/bearer-full.yml	Reusable full scan; critical trusted-checkout failure (3 votes)
.github/workflows/bearer-diff.yml	Reusable differential scan; critical trusted-checkout failure (3 votes) and moderate Markdown injection risk (1 vote)

Review details

Suppressed comments (1)

.github/workflows/bearer-diff.yml:93

• The diff being appended here is entirely PR-controlled, but it is wrapped in a fixed triple-backtick fence. A pull request can add ``` to a .bearer file, close this fence, and inject arbitrary Markdown into the job summary, potentially hiding or spoofing the configuration warning for reviewers. Use a dynamically longer fence or otherwise encode/escape the diff before writing it to `GITHUB_STEP_SUMMARY`.

            git diff --no-color "${range}" -- .bearer

• Files reviewed: 10/10 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The differential scan can be bypassed through PR configuration, and report-rendering tests are missing.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

bearer/scripts/bearer-summary.mjs:1

• The PR description says tests are included, but this change adds no test files or test cases for the new report parser, annotation escaping, severity aggregation, or empty-report path. Please add executable coverage for this workflow support code, or correct the description before relying on it in organization repositories.

#!/usr/bin/env node

• Files reviewed: 10/10 changed files
• Comments generated: 1
• Review effort level: Lite