[imanimanyara]

Summary

Adds a shared job calling laranail/.github's reusable security.yml, which brings this repository an OSV.dev scan and a ggshield secret scan it has never had.

Measured 2026-11-13 across laranail: of 88 packages calling a reusable laranail/.github workflow, security.yml had 1 caller against tests.yml's 39 — while 23 packages ship a standalone security.yml, 20 of which run composer audit and nothing else. The estate was unshared rather than unscanned; what this adds is the two scans, not scanning as such.

Why the local audit job is left exactly as it is

It is not redundant, and replacing it would have been a removal disguised as a migration. This repository's job caches composer, pins its own PHP version and extensions, and on some packages in this pilot runs through a local container action — none of which the shared workflow does. So both run. Dropping the duplicate composer audit is a separate decision to take later with evidence from these runs, not a side effect of this one.

The secret scan before the credential exists

The shared workflow declares OP_SERVICE_ACCOUNT_TOKEN optional and, when it is absent, emits a warning and skips the ggshield step rather than failing. So secrets: inherit is correct both now and once the credential is set. Failing closed is right for a finding — a leaked credential must stop the build — and wrong for a missing setting, which would redden every caller for a reason none of them introduced.

Pilot

One of five: package-tools, console, db-tools, chrono, package-management. The first runs will surface whatever composer audit and OSV have been missing, which is the point and also the reason the pilot is five repositories rather than twenty-three.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.