[devin-ai-integration]

Purpose

• Send CodeQL results to SonarQube Cloud only. Today every CodeQL finding shows up on PRs twice: once as a GitHub code-scanning alert (github-advanced-security comment plus a "CodeQL" check), and once in SonarQube Cloud, which already imports the same SARIF as part of the merged CodeQL + SonarQube report.

Proposed Changes

• [CHANGE] .github/workflows/security-scan.yml: set upload: never on the github/codeql-action/analyze step ("CodeQL Scan"), with a short comment explaining why.

The analyze step still writes the SARIF to its default output directory, ../results. The Post-Process Output step reads it from there, and so do the codeql-artifacts upload and sonar.sarifReportPaths, so none of them change. No other workflow in .github/workflows uploads SARIF to GitHub.

Not in this PR: SonarQube Cloud's own push of issues into GitHub code scanning (alerts titled "SonarCloud /"). That's a SonarQube Cloud setting, not something in this repo. Existing CodeQL alerts in the Security tab stay until they're dismissed.

Issues

• Same change as ci: keep CodeQL results out of GitHub code scanning tile_service#5 and ci: keep CodeQL results out of GitHub code scanning mis_rest_service#5.

Testing

• Security-Scan run on this PR: the CodeQL log shows the upload skipped and the SARIF written to ../results, and the SonarQube scan imports the processed SARIF.

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/ac5361886a7f4b0b8434c2643a5c34a7
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/ac5361886a7f4b0b8434c2643a5c34a7?variant=devin
Requested by: @jl-0

---

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

🤖 Version Auto-Bumped

The version has been automatically incremented to 5.4.5-20261012

This commit was added to your PR branch. When you merge this PR, the new version will be included.

---

_{If you want a different version, update package.json manually and push to this PR.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud