triaging-scan-alertslisted

Diagnose the GitHub **code-scanning alerts** on a PR or branch via `gh`, group them by tool and severity, and report which ones block merge — then present remediation options for the user to choose from. This skill does not edit code or dismiss alerts; it ends with options, not actions. CodeQL runs via GitHub "default setup" (repo settings, not a workflow file). The **required** merge context is the single consolidated `CodeQL` check — the per-language `Analyze (...)` runs do report on human PRs, but they are not the gate (see `docs/contributing/branch-protection.md`). Scorecard uploads supply-chain alerts to the same code-scanning surface. **This skill is reactive by design, and that is not an oversight.** It reads what code scanning has already published; it never triggers a scan and is not a pre-push gate — that half is `creating-prs` Step 8, which checks _pre-existing_ alerts against the files a branch touches, before the push. The split is forced by the platform: a scan cannot analyze code that has not been pushed yet, so nothing earlier than "after the push" has anything new to read. The cost of the split is a wait, and Step 1a below is where this skill pays it — not by scanning earlier, but by refusing to read a scan that has not finished. ## Steps ### 1 — Resolve the PR and repo Confirm `gh` is authenticated, then find the PR for the current branch: ```bash gh auth status gh pr view --json number,headRefName,headRefOid,url,mergeable,mergeStateStatus ``` If no P