From efc3b1b68dd2ec933cfccc34e30ba119fb1fa396 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Fri, 13 Nov 2026 11:57:56 -0500 Subject: [PATCH] Add the shared OSV and secret scans beside the local audit --- .github/workflows/security.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 3c2b1c5..046662d 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -65,3 +65,17 @@ jobs: - name: Composer audit run: composer audit --no-interaction + + # The OSV scan and the secret scan this repository has never had. The local `audit` job above is + # deliberately left alone: it caches composer and pins its own PHP, which the shared workflow does + # not, and its `composer update` audit covers dev dependencies that the shared job's + # `--locked --no-dev` skips. The two are not duplicates; neither is a superset of the other. + shared: + name: shared scans (OSV, secrets) + uses: laranail/.github/.github/workflows/security.yml@main + with: + php-version: '8.5' + php-extensions: 'dom, curl, libxml, mbstring, zip, fileinfo' + # Carries OP_SERVICE_ACCOUNT_TOKEN through for the ggshield step. The shared workflow declares it + # optional and skips with a warning when absent, so this is correct before the credential exists. + secrets: inherit