fix: pin osv-scanner to v2.2.4 (v2.3+ breaks ih-github)

[akuzminsky]

Summary

• osv-scanner v2.3.0+ exits 127 for --help, which breaks infrahouse-toolkit's check_dependencies()
• Pin to v2.2.4 and add osv-scanner --version verification step
• Filed upstream bugs:
  • osv-scanner --help exits with non-zero (127) since v2.3.0 google/osv-scanner#2835 (--help should exit 0 per GNU standard)
  • check_dependencies fails with osv-scanner v2.3+ (--help returns 127) infrahouse-toolkit#246 (tolerate non-zero --help)

Closes #22

Test plan

• Verify vulnerability-check job passes with pinned osv-scanner v2.2.4

🤖 Generated with Claude Code

[github-actions]

State s3://infrahouse-github-control-state/terraform.tfstate

Affected resources counts

Success	Add	🟡 Change	Destroy
✅	0	2	0

Affected resources by action

Action	Resources
🟡	module.aws_service_infrahouse_app.github_repository_file.makefile_fragment[0]
🟡	module.aws_service_infrahouse_app.github_repository_file.vuln_scanner[0]

STDOUT

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.aws_service_infrahouse_app.github_repository_file.makefile_fragment[0] will be updated in-place
  ~ resource "github_repository_file" "makefile_fragment" {
      ~ commit_message      = "Update makefiles/Makefile" -> "Add makefiles/Makefile"
        id                  = "aws-service-infrahouse-app:makefiles/Makefile:main"
        # (9 unchanged attributes hidden)
    }

  # module.aws_service_infrahouse_app.github_repository_file.vuln_scanner[0] will be updated in-place
  ~ resource "github_repository_file" "vuln_scanner" {
      ~ content             = <<-EOT
            # This file is managed by Terraform in github-control repository
            # Do not edit this file, all changes will be overwritten
            ---
            name: OSV-Scanner PR Scan
            
            on:  # yamllint disable-line rule:truthy
              pull_request:
                branches: [main]
              merge_group:
                branches: [main]
            
            permissions:
              contents: read
              pull-requests: write
            
            env:
              GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
            
            jobs:
              vulnerability-check:
                runs-on: ubuntu-24.04
                steps:
                  - uses: actions/checkout@v6
                  - name: Set up Python
                    uses: actions/setup-python@v6
                    with:
                      python-version: "3.14"
                  - name: Install dependencies
                    run: pip install -r requirements.txt
                  - name: Install osv-scanner
                    run: |
          -           OSV_VERSION=$(curl -s https://api.github.com/repos/google/osv-scanner/releases/latest | python -c "import sys,json;print(json.load(sys.stdin)['tag_name'].lstrip('v'))")
          +           curl -fsSL -o /usr/local/bin/osv-scanner "https://github.com/google/osv-scanner/releases/download/v2.2.4/osv-scanner_linux_amd64"
          -           curl -fsSL -o /usr/local/bin/osv-scanner "https://github.com/google/osv-scanner/releases/download/v${OSV_VERSION}/osv-scanner_linux_amd64"
          +           chmod +x /usr/local/bin/osv-scanner
          -           chmod +x /usr/local/bin/osv-scanner
          +           osv-scanner --version
                  - name: Detect vulnerabilities
                    run: |
                      if [ -n "${{ github.event.pull_request.number }}" ]; then
                        ih-github scan \
                        --repo ${{ github.repository }} \
                        --pull-request ${{ github.event.pull_request.number }}
                      else
                        ih-github scan
                      fi
            
              sast-check:
                runs-on: ubuntu-24.04
                steps:
                  - uses: actions/checkout@v6
                  - name: Set up Python
                    uses: actions/setup-python@v6
                    with:
                      python-version: "3.14"
            
                  - name: Install dependencies
                    run: pip install -r requirements.txt
                  - name: SAST
                    run: |
                      if [ -n "${{ github.event.pull_request.number }}" ]; then
                        ih-github run \
                        ${{ github.repository }} \
                        ${{ github.event.pull_request.number }} \
                        semgrep scan --error
                      else
                        semgrep scan --error
                      fi
        EOT
        id                  = "aws-service-infrahouse-app:.github/workflows/vuln-scanner-pr.yml:main"
        # (9 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.ih_8_repos.github_repository.repo,
  on modules/local-repo/repos.tf line 4, in resource "github_repository" "repo":
   4:   has_downloads        = false

This attribute is no longer in use, but it hasn't been removed yet. It will
be removed in a future version. See
https://github.com/orgs/community/discussions/102145#discussioncomment-8351756

(and 6 more similar warnings elsewhere)

Warning: Deprecated attribute

  on .terraform/modules/actions-runner-pem-493370826424-uw1/data_sources.tf line 11, in data "external" "secret_value":
  11:     "python", "${path.module}/assets/get_secret.py", data.aws_region.current.name, aws_secretsmanager_secret.secret.id, data.aws_iam_role.caller_role.arn

The attribute "name" is deprecated. Refer to the provider documentation for
details.

(and 5 more similar warnings elsewhere)

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tf.plan

To perform exactly these actions, run the following command to apply:
    terraform apply "tf.plan"

metadata

eyJzMzovL2luZnJhaG91c2UtZ2l0aHViLWNvbnRyb2wtc3RhdGUvdGVycmFmb3JtLnRmc3RhdGUiOiB7InN1Y2Nlc3MiOiB0cnVlLCAiYWRkIjogMCwgImNoYW5nZSI6IDIsICJkZXN0cm95IjogMH19