Add security-query.sql returning count of malicious and reachable vulnerability situations

[Copilot]

The existing query returned individual vulnerability rows with a categorical reason label. The requirement is to instead return a count per situation type (malicious / reachable with high EPSS%).

Changes

• New file security-query.sql — replaces the per-row result set with aggregated counts grouped by reason:
  • COUNT(*) AS count added to SELECT
  • GROUP BY reduced from 9 columns to just GROUP BY reason
  • QUALIFY clause removed (window function over project not meaningful when aggregating)
  • ORDER BY reason replaces ORDER BY LOWER(CVSS3_SEVERITY)

SELECT
CASE WHEN MALICIOUS = true THEN 'Malicious code detected 🚩'
WHEN REACHABILITY ='REACHABLE'AND EPSS_PERCENTAGE >=60 THEN 'Reachable vulnerability with high EPSS% 🔴'
ELSE ''
END as reason,
COUNT(*) AS count
FROM (...)
WHERE ...
GROUP BY reason
ORDER BY reason;

Output shape is now 2 rows max — one per situation — each with its count for the filtered repo(s) and date range.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.