From 473fdb621ac14ec009e926b9a5631060c9ef6b83 Mon Sep 17 00:00:00 2001
From: QuentinBisson <quentin@giantswarm.io>
Date: Sat, 20 Jun 2026 14:47:10 +0200
Subject: [PATCH] Add vulnerability-check workflow (merge-queue nancy scan)

Calls the github-workflows vulnerability-check reusable workflow on
pull_request and merge_group, so the nancy scan can gate the merge
queue and run once per merge instead of on every CircleCI build.
---
 .github/workflows/vulnerability-check.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/vulnerability-check.yaml

diff --git a/.github/workflows/vulnerability-check.yaml b/.github/workflows/vulnerability-check.yaml
new file mode 100644
index 0000000..78c52a4
--- /dev/null
+++ b/.github/workflows/vulnerability-check.yaml
@@ -0,0 +1,21 @@
+name: vulnerability-check
+
+on:
+  pull_request:
+    branches:
+      - main
+  merge_group:
+    types:
+      - checks_requested
+
+permissions: {}
+
+jobs:
+  nancy:
+    uses: giantswarm/github-workflows/.github/workflows/vulnerability-check.yaml@main
+    permissions:
+      contents: read
+    secrets:
+      NANCY_USER: ${{ secrets.NANCY_USER }}
+      NANCY_TOKEN: ${{ secrets.NANCY_TOKEN }}
+      OSSI_OSSINDEXURL: ${{ secrets.OSSI_OSSINDEXURL }}