fix: pass reusable workflow input from event

[brendan-kellam]

References SOU-1830.

GitHub only allows the github and needs contexts in a reusable-workflow job with block. Read the manual input through github.event.inputs and convert it with fromJSON so both workflow_dispatch and scheduled runs pass a number; scheduled runs retain the default of 50.

Validation:

• CVE remediation regression suite
• shell syntax
• YAML parsing
• actionlint

---

Note

Low Risk
Workflow-only change to satisfy GitHub Actions context rules; behavior intent (default 50, optional manual limit) stays the same.

Overview
Fixes how Nightly CVE Remediation passes max_issues into the reusable _cve-remediation.yml job. GitHub only allows github and needs in a uses: block, so the caller no longer references ${{ inputs.max_issues }}.

The caller now uses ${{ fromJSON(github.event.inputs.max_issues || '50') }}, so manual runs honor the workflow_dispatch input and scheduled runs still get the numeric default of 50.

The CVE remediation regression script can assert against either workflow file and adds checks that the caller uses the allowed expression and does not reference the invalid inputs context.

^{Reviewed by Cursor Bugbot for commit 25fc407. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Fixed CVE remediation workflow handling for manually supplied issue limits.
  • Preserved the default limit of 50 issues when no custom value is provided.
  • Improved workflow validation to ensure issue limits are passed and interpreted correctly.

[github-actions]

@brendan-kellam your pull request is missing a changelog!

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2388e20b-52f8-4ae9-84ce-6b006c9e62c1

📥 Commits

Reviewing files that changed from the base of the PR and between fcb1285 and 25fc407.

📒 Files selected for processing (2)

• .github/scripts/test-cve-remediation.sh
• .github/workflows/cve-remediation.yml

---

Walkthrough

The caller workflow now converts max_issues before passing it to the reusable workflow. The CVE remediation test script validates numeric propagation and rejects use of the unavailable inputs.max_issues context.

Changes

CVE remediation issue-limit propagation

Layer / File(s)	Summary
Convert the caller issue limit .github/workflows/cve-remediation.yml	The caller workflow uses fromJSON for max_issues and retains a default of 50.
Validate workflow issue-limit contexts .github/scripts/test-cve-remediation.sh	The test helpers accept an optional workflow path. Assertions verify numeric issue-limit propagation and prohibit inputs.max_issues in the reusable workflow.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• sourcebot-dev/sourcebot#1538: Directly modifies the CVE remediation caller workflow and its related test script.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brendan/sou-1830-fix-reusable-input

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}