Cover live worktrees in security audits

tools/checks/check-security-audit.sh

@@ -180,13 +180,17 @@ run_semgrep() {
   fi
   semgrep scan \
     --metrics=off \
+    --no-git-ignore \
     --sarif \
     --output "$report" \
+    --exclude .git \
     --exclude node_modules \
     --exclude .venv \
     --exclude dist \
     --exclude build \
     --exclude runtime \
+    --exclude audit-reports \
+    --exclude '**/.*-test-build/**' \
     "${config_args[@]}" \
     "${REPOS[@]}"
 }
@@ -222,7 +226,16 @@ run_gitleaks() {
       gitleaks git \
         --config "$ROOT/.gitleaks.toml" \
         --report-format json \
-        --report-path "$REPORTS_DIR/gitleaks-$name.json" \
+        --report-path "$REPORTS_DIR/gitleaks-history-$name.json" \
+        --no-banner \
+        "$repo" || status=1
+      # History scanning does not include new or modified working-tree files.
+      # Scan the directory as well so pre-commit audits cover the exact code
+      # under review, while retaining the history scan above.
+      gitleaks dir \
+        --config "$ROOT/.gitleaks.toml" \
+        --report-format json \
+        --report-path "$REPORTS_DIR/gitleaks-worktree-$name.json" \
         --no-banner \
         "$repo" || status=1
     else
@@ -261,7 +274,9 @@ run_pip_audit_manifests() {
     [[ -f "$repo/requirements.txt" ]] || continue
     local name
     name="$(safe_name "$repo")"
-    pip-audit -r "$repo/requirements.txt" --progress-spinner off --format json --output "$REPORTS_DIR/pip-audit-$name.json" || status=1
+    # Requirements may contain project-relative entries such as `.[server]`.
+    # Resolve them from the owning repository instead of the meta-repository.
+    (cd "$repo" && pip-audit -r requirements.txt --progress-spinner off --format json --output "$REPORTS_DIR/pip-audit-$name.json") || status=1
   done
   return "$status"
 }
@@ -283,7 +298,11 @@ run_osv_scanner() {
     local name
     name="$(safe_name "$repo")"
     if osv-scanner scan --help >/dev/null 2>&1; then
-      osv-scanner scan -r --format json --output "$REPORTS_DIR/osv-scanner-$name.json" "$repo" || status=1
+      osv-scanner scan -r \
+        --allow-no-lockfiles \
+        --format json \
+        --output-file "$REPORTS_DIR/osv-scanner-$name.json" \
+        "$repo" || status=1
     else
       osv-scanner -r --format json --output "$REPORTS_DIR/osv-scanner-$name.json" "$repo" || status=1
     fi