Timeline: tag Code Scanning event stories with taxonomy data-* attributes

[janmaarten-a11y]

Summary

Adds per-row data-* taxonomy attributes to the Code Scanning Timeline event stories. This is the Phase 3 tagging fan-out (github/primer#6664, epic github/primer#6654) applied to the Code Scanning surface, following the proven License Compliance pilot (#8216).

Every Timeline.Item in Timeline.code-scanning.features.stories.tsx now spreads a small local codeScanningAttrs helper that projects the row through the shared toEventDataAttributes serializer from the taxonomy module (#8180, docs #6888). It emits data-event-scope, data-event-type, data-event-category, data-event-visibility, and (for actor rows) data-actor-type.

This is the same contract as the License Compliance pilot (#8216) consuming the taxonomy module (#8180): the story derives category and visibility FROM CODE_SCANNING_TAXONOMY rather than hand-maintaining them, and resolves data-actor-type from the rendered actor login via actorTypeForLogin. System rows (no rendered actor) pass no login, so data-actor-type is omitted entirely.

Storybook-only, no visual change. This file is intentionally not wired into components-json or the docs page, so nothing consumer-facing changes.

Per-row attributes

• Detected group (First detected, Appeared, Reappeared): system events, data-event-type detected / appeared / reappeared, category findings, no data-actor-type.
• Fixed group: the two "Fixed in branch" rows carry data-event-type="fixed" (category findings), system, no actor.
• Closed by user (false positive, used in tests, won't fix, no resolution): data-event-type="closed" (category status) with data-actor-type="user".
• Reopened: data-event-type="reopened", user actor.
• Dismissal requested: data-event-type="dismissal_requested", user actor.
• Dismissal reviewed (approved, denied): data-event-type="dismissal_reviewed", user actor.

The one judgment call: Configuration deleted maps to closed

The EventFixed story visually groups two "Configuration deleted" rows alongside the "Fixed in branch" rows. These rows are the ALERT_CLOSED_BECAME_OUTDATED wire event, which the taxonomy catalog folds into closed (a system closure), not fixed (see the CODE_SCANNING_TAXONOMY comment: closed: folds BECAME_OUTDATED (system) + CLOSED_BY_USER (user)). So the two "Configuration deleted" rows carry data-event-type="closed" (category status), while the two "Fixed in branch" rows carry data-event-type="fixed". Both are system config/fix events with no rendered actor, so neither emits data-actor-type. A code comment on the EventFixed story documents this classification. Flagging it here for reviewer confirmation.

All Code Scanning leaves are cataloged; there are no parked or shared events on this surface, so nothing is left untagged.

Changelog

New

Nothing consumer-facing. Storybook-only taxonomy tagging.

Changed

Code Scanning Timeline event stories now render per-row data-* taxonomy attributes.

Removed

Nothing.

Rollout strategy

• None; Storybook-only change with no consumer-facing or published-package impact, so no changeset is needed.

Testing & Reviewing

Rendered the EventDetected, EventFixed, and EventClosedByUser stories headlessly and asserted the emitted attributes: Detected rows have no data-actor-type and category findings; the "Fixed in branch" row is data-event-type="fixed" (no actor) while "Configuration deleted" is data-event-type="closed" (no actor); the Closed-by-user row is data-event-type="closed" with data-actor-type="user". Zero console errors. Prettier, ESLint, Stylelint, and type-check all pass with zero new errors.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e927479

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[janmaarten-a11y]

Closing: consolidating all four Timeline surface-tagging changes into one combined PR. Branch janmaarten-a11y-timeline-tag-code-scanning-stories stays pushed for integration.