feat: reusable secret scanning, SAST, dependency and lint workflows

.forgejo/workflows/sast.yml

@@ -0,0 +1,28 @@
+# Static analysis with semgrep.
+#
+# Defaults to the curated p/default ruleset rather than `--config auto`, because
+# auto requires sending metrics to semgrep.dev. Paths are excluded with a
+# .semgrepignore in the calling repo; a single finding can be suppressed inline
+# with a `nosemgrep: <rule-id>` comment.
+on:
+  workflow_call:
+    inputs:
+      config:
+        description: Space-separated semgrep configs (registry packs or paths in the repo).
+        type: string
+        default: p/default
+
+jobs:
+  semgrep:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: semgrep
+        env:
+          CONFIGS: ${{ inputs.config }}
+          SEMGREP_SEND_METRICS: "off"
+        run: |
+          semgrep --version
+          set -- scan --error --metrics=off --disable-version-check
+          for c in $CONFIGS; do set -- "$@" --config "$c"; done
+          semgrep "$@"