fix(workflow): repair CodeQL run lookup in advisory poller

[davida-ps]

User description

Summary

• fix the advisory poller CodeQL wait step by piping gh run list JSON into jq when using jq variables
• keep the existing head SHA and dispatch-time filtering behavior
• add a workflow regression assertion so gh --jq is not used with jq CLI flags again

Why

Recent scheduled Poll NVD CVEs runs create/update the automated advisory PR, then fail because gh run list treats --arg as an unknown gh flag. That leaves advisory updates in PR #257 instead of cleanly completing the workflow.

Validation

• node scripts/test-nvd-ghsa-consolidation-workflow.mjs
• node scripts/test-ghsa-without-cve-feed.mjs
• node scripts/test-nvd-ghsa-pipeline-dry-run.mjs
• git diff --check

---

Generated description

Below is a concise technical summary of the changes proposed in this PR:
Correct the poll-nvd-cves workflow's CodeQL wait step to pipe gh run list JSON into jq -r --arg filters so dispatch-time and head SHA checks run without passing jq flags to gh. Add regression assertions in the NVD GHSA consolidation tests to ban --jq --arg usage and require the expected jq -r --arg filtering pattern for the CodeQL run lookup.

Topic	Details
CodeQL run lookup	Fix the CodeQL run lookup in the poll-nvd-cves workflow by piping the gh run list JSON output through jq -r --arg filters to maintain the existing dispatch-time and head SHA selection without passing jq flags to gh. Modified files (1) .github/workflows/poll-nvd-cves.yml Latest Contributors(2) User Commit Date David.a@prompt.security fix(workflow): filter ... June 09, 2026 david.a@prompt.security fix(workflow): wait fo... May 27, 2026
Regression assertions	Add regression assertions in the NVD GHSA consolidation tests to forbid --jq --arg usage and verify the new jq -r --arg filtering pattern for the CodeQL run lookup. Modified files (1) scripts/test-nvd-ghsa-consolidation-workflow.mjs Latest Contributors(2) User Commit Date David.a@prompt.security fix(workflow): filter ... June 09, 2026 david.a@prompt.security feat(advisories): add ... May 24, 2026

_{Review this PR on Baz | Customize your next review}