[imanimanyara]

Summary

Adds a shared job calling laranail/.github's reusable security.yml, bringing this repository an OSV.dev scan and a ggshield secret scan it has never had.

Measured 2026-11-13 across laranail: of 88 packages calling a reusable laranail/.github workflow, security.yml had 1 caller against tests.yml's 39, while 23 packages shipped a standalone security.yml running composer audit and nothing else. The estate was unshared rather than unscanned; what this adds is the two scans.

The local audit job is deliberately untouched

It is not a duplicate, and neither job is a superset of the other:

• the local job runs composer update --prefer-stable and audits everything, including dev dependencies;
• the shared job runs composer install then composer audit --locked --no-dev, which skips the dev tree — where roave/security-advisories and the test toolchain live.

The local job also caches composer and pins its own PHP, which the shared workflow does not. Replacing it would have been a removal dressed as a migration. These repositories are public, so the second composer audit run costs nothing.

The secret scan before the credential exists

The shared workflow declares OP_SERVICE_ACCOUNT_TOKEN optional and, when absent, emits a warning and skips the ggshield step rather than failing. secrets: inherit is therefore correct both now and once the credential is set. Failing closed is right for a finding and wrong for a missing setting.

Rolled out after a five-repo pilot

package-tools, console, db-tools, package-management and chrono went first. The pilot earned its keep: it found that the shared workflow's osv-scan job hardcoded php-version: '8.4' while composer-audit honoured the input, so every caller with a PHP floor above 8.4 failed with composer's "Your requirements could not be resolved" — an error naming neither PHP nor a version, inside a job called "OSV.dev scan". Fixed in laranail/.github#29 before this rollout, which is why php-version here is this repository's own value rather than a default.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.