Add structured metadata fields to findings for programmatic access

[fproulx-boostsecurity]

Summary

• Adds new structured metadata fields (injection_sources, lotp_tool, lotp_action, referenced_secrets) to findings, enabling programmatic access to security-relevant information without parsing human-readable text
• Implements helper functions in poutine/utils.rego to extract and sort injection sources from tainted expressions
• The referenced_secrets field is automatically extracted when rules pass the _job field, supporting dot notation (secrets.FOO) and bracket notation (secrets['FOO'] and secrets["FOO"])
• Adds comprehensive documentation for the new fields with usage examples and integration guidance

Benchmark (Apple M4 Pro)

Version	ns/op	B/op	allocs/op
Before	10971339	7149084	132787
After	12059356	7858242	148422
Delta	+9.9%	+9.9%	+11.8%

Test plan

• All existing tests pass
• Added new test workflow (test_new_fields.yml) to verify structured metadata extraction
• Added TestStructuredFindingFields test with assertions for new fields
• Verified SARIF formatter tests pass (new fields are in JSON output, not SARIF properties per existing design)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This pull request adds structured metadata fields to security findings, enabling programmatic access to security-relevant information without parsing human-readable text. The implementation includes new fields for injection sources, LOTP (Living Off The Pipeline) tools/actions, and referenced secrets.

Changes:

• Added four new structured metadata fields to FindingMeta: InjectionSources, LOTPTool, LOTPAction, and ReferencedSecrets
• Implemented Rego helper functions to extract and sort injection sources and secrets from GitHub Actions expressions
• Updated all existing test expectations to include the new structured fields with appropriate values
• Added comprehensive test workflow and test case to verify the new fields are populated correctly

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
results/results.go	Adds four new structured metadata fields to FindingMeta struct with clear documentation
opa/rego/poutine/utils.rego	Implements helper functions to extract secrets from GitHub Actions expressions using regex patterns for dot and bracket notation
opa/rego/poutine.rego	Modifies finding() function to automatically extract referenced_secrets from _job field for GitHub Actions findings
opa/rego/rules/injection.rego	Adds injection_sources field (sorted array) and _job field to GitHub Actions injection findings
opa/rego/rules/untrusted_checkout_exec.rego	Adds lotp_tool/lotp_action fields and _job field to GitHub Actions untrusted checkout exec findings, also adds job ID to finding metadata
scanner/testdata/.github/workflows/test_new_fields.yml	New test workflow with injection vulnerabilities and LOTP scenarios to validate structured metadata extraction
scanner/inventory_test.go	Updates all test expectations with new structured fields and adds TestStructuredFindingFields to validate the implementation
scanner/inventory_scanner_test.go	Adds new test workflow to the expected workflow list
docs/content/en/structured-finding-metadata.md	Comprehensive documentation explaining the new fields, usage examples, and backward compatibility

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.