ci: reuse shared security workflows

.github/workflows/codeql.yml

@@ -10,7 +10,6 @@ on:
 
 permissions:
   contents: read
-  actions: read
 
 concurrency:
   # Supersede in-flight runs for the same PR; pushes to main always finish.
@@ -19,29 +18,13 @@ concurrency:
 
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
+    name: Analyze (javascript-typescript)
+    uses: AgentsKit-io/.github/.github/workflows/codeql.yml@5a584290feaaa0a800a28d24583d16f15102bea1 # main
+    with:
+      languages: javascript-typescript
+      queries: security-and-quality
+      build-mode: none
     permissions:
+      actions: read
       contents: read
       security-events: write
-      actions: read
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [javascript-typescript]
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
-        with:
-          languages: ${{ matrix.language }}
-          queries: security-and-quality
-
-      - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
-        with:
-          category: '/language:${{ matrix.language }}'

.github/workflows/dependency-review.yml

@@ -15,28 +15,31 @@ concurrency:
 jobs:
   review:
     name: Dependency Review
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Review new dependencies
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          fail-on-severity: high
+    uses: AgentsKit-io/.github/.github/workflows/dependency-review.yml@5a584290feaaa0a800a28d24583d16f15102bea1 # main
+    with:
+      fail-on-severity: high
+    permissions:
+      contents: read
+      pull-requests: read
 
   audit:
     name: npm audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci --ignore-scripts
-      - run: npm audit --omit=dev --audit-level=high
-      - run: npm ci --prefix apps/docs --ignore-scripts
-      - run: npm audit --prefix apps/docs --audit-level=high
+    uses: AgentsKit-io/.github/.github/workflows/audit.yml@5a584290feaaa0a800a28d24583d16f15102bea1 # main
+    with:
+      package-manager: npm
+      working-directories: '["."]'
+      audit-level: high
+      production-only: true
+    permissions:
+      contents: read
+
+  docs-audit:
+    name: npm audit (apps/docs)
+    uses: AgentsKit-io/.github/.github/workflows/audit.yml@5a584290feaaa0a800a28d24583d16f15102bea1 # main
+    with:
+      package-manager: npm
+      working-directories: '["apps/docs"]'
+      audit-level: high
+      production-only: false
+    permissions:
+      contents: read

.github/workflows/scorecard.yml

@@ -6,37 +6,14 @@ on:
   schedule:
     - cron: '30 1 * * 6'
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-latest
+    uses: AgentsKit-io/.github/.github/workflows/scorecard.yml@5a584290feaaa0a800a28d24583d16f15102bea1 # main
     permissions:
-      security-events: write
+      contents: read
       id-token: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Run analysis
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
-        with:
-          sarif_file: results.sarif
+      security-events: write