fix(security): preserve required check names in private-free migration

.github/workflows/private-security-bundle-free.yml

@@ -7,6 +7,10 @@ name: private-security-bundle-free
 on:
   workflow_call:
     inputs:
+      check_name:
+        description: 'Job display name; preserve the existing name when migrating a required check.'
+        type: string
+        default: 'actionlint + zizmor + OSV + gitleaks (no SARIF)'
       runner:
         description: 'Private Linux X64 runner label.'
         type: string
@@ -36,7 +40,7 @@ permissions: {}
 
 jobs:
   security-bundle:
-    name: actionlint + zizmor + OSV + gitleaks (no SARIF)
+    name: ${{ inputs.check_name }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     permissions:

CHANGELOG.md

@@ -7,6 +7,10 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+- Add optional `check_name` to the private-free security bundle so callers can
+  retain an existing required check identity when migrating away from SARIF
+  publication, with all four scanners and evidence artifacts preserved.
+
 - Synchronize pins by catalog action family, preserving independent subpath actions
   and reusable workflows in the same repository. Apply the reviewed dependency
   updates from #92 with matching catalog and transitive-image records; historical

catalog/capabilities.yml

@@ -299,6 +299,7 @@ capabilities:
       - "Private repositories only; public forks must never reach self-hosted capacity"
       - "SARIF remains an artifact rather than a code-scanning upload because private-free repositories have no security-events entitlement"
       - "Four gates share one failure domain, but every gate executes before aggregate failure"
+      - "Optional check_name preserves the inner job display name during required-check migration; caller prefix and scanner enforcement remain separate"
       - "Called-workflow implementation is fetched at exact job.workflow_sha outside the caller workspace"
       - "Gitleaks evidence is fully redacted before the always-uploaded one-day artifact is created"
     deprecations: null

docs/02-private-free.md

@@ -104,10 +104,20 @@ and replace its placeholder runner label with a private, isolated fleet label.
 
 `private-security-bundle-free.yml` runs actionlint, zizmor, OSV-Scanner and
 Gitleaks in one private Linux placement. All four gates execute before the job
-aggregates failure. The job always uploads one-day evidence containing the
+aggregates failure. After scanning runs, the job uploads one-day evidence containing the
 actionlint log plus Zizmor, OSV and fully redacted Gitleaks SARIF reports; it
 does not require or attempt a paid code-scanning upload.
 
+When migrating an existing caller from `nddev-security-bundle.yml`, preserve
+its caller job key/name and inspect the exact required check context. The free
+workflow defaults its inner job name to
+`actionlint + zizmor + OSV + gitleaks (no SARIF)`. Set the optional `check_name`
+to `actionlint + zizmor + OSV + gitleaks` when that is the existing protected
+inner name. This input affects only the displayed check name; it does not alter
+scanner execution, failure handling, artifact evidence or token permissions.
+The caller needs only `contents: read`; no Code Security feature or
+`security-events: write` permission is required by this variant.
+
 Use this workflow when placement latency and fleet contention cost more than
 the limited failure-domain isolation of four separate jobs. Public fork code
 must remain on GitHub-hosted runners and must never call this private lane.

examples/private-free/security-selfhosted.yml

@@ -19,6 +19,8 @@ jobs:
     uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/private-security-bundle-free.yml@<sha>
     with:
       runner: private-ci
+      # Optional: keep a pre-existing inner job name when moving from the SARIF bundle.
+      check_name: actionlint + zizmor + OSV + gitleaks
   validate:
     permissions: { contents: read }
     uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/private-static.yml@<sha>