From b97788711715b3b31383f43cca3437e89d6f78a2 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Fri, 13 Nov 2026 11:58:08 -0500 Subject: [PATCH] Add the shared OSV and secret scans beside the local audit --- .github/workflows/security.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 7953606..6f00fd9 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -52,3 +52,16 @@ jobs: - run: composer update --prefer-dist --no-interaction --no-progress - run: composer audit + + # The OSV scan and the secret scan this repository has never had. The local `audit` job above is + # deliberately left alone: it caches composer and pins its own PHP, which the shared workflow does + # not, and its `composer update` audit covers dev dependencies that the shared job's + # `--locked --no-dev` skips. The two are not duplicates; neither is a superset of the other. + shared: + name: shared scans (OSV, secrets) + uses: laranail/.github/.github/workflows/security.yml@main + with: + php-version: '8.4' + # Carries OP_SERVICE_ACCOUNT_TOKEN through for the ggshield step. The shared workflow declares it + # optional and skips with a warning when absent, so this is correct before the credential exists. + secrets: inherit