Timeline: tag Secret Scanning event stories with taxonomy data-* attributes

[janmaarten-a11y]

Part of the Phase 3 taxonomy tagging fan-out (github/primer#6664, epic github/primer#6654), following the License Compliance pilot (#8216). This is Storybook-only and produces no visual change.

It tags the Secret Scanning Timeline event stories with the same event data-* contract as the LC pilot, projected from the merged taxonomy module (#8180) and documented in github/primer#6888. A small secretScanningAttrs(type, login) helper reads category and visibility from SECRET_SCANNING_TAXONOMY and resolves the actor via actorTypeForLogin, then spreads the result onto each cataloged Timeline.Item.

The Secret Scanning catalog was scoped to the five live event-switch cases (seven leaves) and is narrower than the shipped story set, so many variants have no catalog leaf. Those are intentionally left untagged, each with an inline comment.

Per-row attributes

Each tagged row carries data-event-scope="secret-scanning", data-event-type (the unscoped leaf), data-event-category and data-event-visibility (from the catalog), and data-actor-type (from the rendered actor login, omitted when no actor).

Tagged leaves:

• EventCreated "Created" to detected (findings). Renders the GitHub system-identity actor.
• EventResolution: the seven "Closed as ..." variants to closed; the "Reopened" section's leading closed context row also closed; "Reopened" to reopened.
• EventBypass "Bypassed push protection" to bypassed.
• EventValidityChange: all six "Validity: ..." variants to validity_changed (automated rows render the GitHub system actor, manual rows a user actor).
• EventClosureRequest: both "Dismissal requested" variants to dismissal_requested; "Dismissal approved" and "Dismissal denied" to dismissal_reviewed.

Intentionally left untagged (no catalog leaf, or parked/shared)

• EventBypass "Bypass requested" and "Bypass approved" (delegated bypass): the delegated-bypass flow has no catalog leaf. The catalog's dismissal_requested/reviewed cover the delegated-closure flow, a different thing.
• EventReport "Reported": the catalog maps Report to validity_changed, but the docs (github/primer#6888) list that mapping as unconfirmed (open item Make an Octicons component #2). Left untagged rather than emit an unconfirmed value.
• EventClosureRequest "Dismissal request cancelled": Secret Scanning has no dismissal_cancelled leaf (unlike Dependabot).
• EventMetadata ("Extended metadata found" / "removed"): parked per the docs.
• EventAssignment (all five variants): a cross-surface shared event, deliberately out of the per-surface catalog.

Flagged judgment calls for review

• The GitHub system-identity actor classifies as data-actor-type="user" because actorTypeForLogin('GitHub') returns user (GitHub is not in the bot set). Whether a system identity should classify as user vs bot is worth confirming.
• The Report to validity_changed mapping is unconfirmed per github/primer#6888 open item Make an Octicons component #2, so EventReport is left untagged.

Changelog

Changed

• Secret Scanning Timeline feature stories now carry taxonomy data-* attributes on cataloged event rows (Storybook-only).

Rollout strategy

• None; Storybook-only change with no runtime or published API impact.

Testing & Reviewing

Ran prettier, eslint, and type-check (all pass). Rendered the stories headlessly and confirmed: EventCreated to data-event-scope="secret-scanning" data-event-type="detected" data-event-category="findings" data-actor-type="user"; an EventResolution "Closed as ..." row to data-event-type="closed"; an EventClosureRequest approved row to data-event-type="dismissal_reviewed"; six validity_changed rows; and that EventReport, EventMetadata, EventAssignment, the two delegated Bypass rows, and the Dismissal-cancelled row carry no data-event-* attributes. Zero console errors.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 91cf463

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[janmaarten-a11y]

Closing: consolidating the four Timeline surface-tagging changes into one combined PR. Branch janmaarten-a11y-timeline-tag-secret-scanning-stories stays intact at 91cf463 for integration.