feat: reusable secret scanning, SAST, dependency and lint workflows

.forgejo/workflows/deps.yml

@@ -0,0 +1,26 @@
+# Known-vulnerable dependencies, via osv-scanner against the OSV database.
+#
+# Reads every lockfile and manifest it recognises (pnpm/npm/yarn, pip/uv/poetry,
+# go.mod, NuGet, Cargo and more). Accepted vulnerabilities go in an
+# osv-scanner.toml in the calling repo as [[IgnoredVulns]] entries with a
+# reason and an ignoreUntil date, so an exception expires instead of
+# silently living forever.
+on:
+  workflow_call:
+
+jobs:
+  osv-scanner:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: osv-scanner
+        run: |
+          osv-scanner --version | head -1
+          rc=0
+          osv-scanner scan source --recursive . || rc=$?
+          # 128 means no lockfile or manifest was found: nothing to check, not a failure.
+          if [ "$rc" -eq 128 ]; then
+            echo "No supported lockfiles or manifests found; nothing to scan."
+            exit 0
+          fi
+          exit "$rc"