Fix attestation creation and CodeQL data extraction

- Add delays between attestation creation to prevent conflicts
- Increase CodeQL API wait time from 10s to 30s
- Improve error handling for CodeQL data extraction
- Add better fallback data when API calls fail

Author: eltyagi

.github/workflows/unified-build-attest.yml

@@ -73,8 +73,9 @@ jobs:
         run: |
           echo "🔍 Extracting CodeQL security results..."
           
-          # Wait a moment for results to be processed
-          sleep 10
+          # Wait longer for results to be processed
+          echo "⏳ Waiting for CodeQL results to be available in API..."
+          sleep 30
           
           # Get CodeQL alerts for this commit/ref
           if [ "${{ github.event_name }}" = "pull_request" ]; then
@@ -88,13 +89,14 @@ jobs:
           echo "📊 Checking alerts for ref: $REF_NAME, commit: $COMMIT_SHA"
           
           # Get alerts from the API
+          echo "🔍 Fetching CodeQL alerts from API..."
           ALERTS_DATA=$(gh api repos/${{ github.repository }}/code-scanning/alerts \
-            --jq --arg ref "$REF_NAME" '
+            --jq --arg ref "$REF_NAME" --arg commit "$COMMIT_SHA" '
             map(select(.state == "open")) |
             {
               scan_timestamp: now | strftime("%Y-%m-%dT%H:%M:%SZ"),
-              commit_sha: "'"$COMMIT_SHA"'",
-              ref: "'"$REF_NAME"'",
+              commit_sha: $commit,
+              ref: $ref,
               total_alerts: length,
               severity_counts: {
                 critical: map(select(.rule.security_severity_level == "critical")) | length,
@@ -111,18 +113,29 @@ jobs:
                 severity: .[0].rule.security_severity_level
               }) | sort_by(.count) | reverse | .[0:10]),
               tools_used: ["codeql"],
-              languages_scanned: ["python"]
-            }' 2>/dev/null) || echo '{
-              "scan_timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
-              "commit_sha": "'"$COMMIT_SHA"'",
-              "ref": "'"$REF_NAME"'",
-              "total_alerts": 0,
-              "severity_counts": {"critical": 0, "high": 0, "medium": 0, "low": 0, "note": 0, "warning": 0},
-              "rule_summary": [],
-              "tools_used": ["codeql"],
-              "languages_scanned": ["python"],
-              "note": "No alerts found or API access limited"
-            }'
+              languages_scanned: ["python"],
+              scan_context: {
+                analysis_key: ".github/workflows/unified-build-attest.yml:build-scan-attest",
+                category: "/language:python"
+              }
+            }' 2>/dev/null) || {
+              echo "⚠️  Failed to fetch alerts from API, creating fallback summary..."
+              ALERTS_DATA='{
+                "scan_timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
+                "commit_sha": "'"$COMMIT_SHA"'",
+                "ref": "'"$REF_NAME"'",
+                "total_alerts": 0,
+                "severity_counts": {"critical": 0, "high": 0, "medium": 0, "low": 0, "note": 0, "warning": 0},
+                "rule_summary": [],
+                "tools_used": ["codeql"],
+                "languages_scanned": ["python"],
+                "note": "CodeQL scan completed but alerts not available via API at attestation time",
+                "scan_context": {
+                  "analysis_key": ".github/workflows/unified-build-attest.yml:build-scan-attest",
+                  "category": "/language:python"
+                }
+              }'
+            }
           
           echo "security_summary<<EOF" >> $GITHUB_OUTPUT
           echo "$ALERTS_DATA" >> $GITHUB_OUTPUT
@@ -145,6 +158,9 @@ jobs:
         with:
           subject-path: ${{ steps.build.outputs.artifact_name }}
 
+      - name: Wait between attestations
+        run: sleep 2
+
       - name: Create security assessment attestation
         uses: actions/attest@v1
         with:
@@ -221,6 +237,9 @@ jobs:
               }
             }
 
+      - name: Wait between attestations
+        run: sleep 2
+
       - name: Verify attestations
         run: |
           echo "🔐 Verifying created attestations..."