feat: shared scan baseline as a reusable workflow

[altaywtf]

Problem

The scan baseline (gitleaks, trufflehog, actionlint, zizmor) exists as copied workflow files in design and skillcheck, partially in a few repos, and not at all in most; every version or digest bump costs one commit per repo.

Solution

One workflow_call workflow here carries all four jobs, every image digest-pinned (a version tag is mutable, and each container gets the whole repository). Repositories add a ~10-line caller:

jobs:
  scan:
    uses: uinaf/.github/.github/workflows/scan.yml@main

Rollout lands per repo after a pilot proves the call path. Decides the open call on ffsstack#53.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Introduces a reusable GitHub Actions workflow (workflow_call) that centralizes the organization’s “scan baseline” (gitleaks, trufflehog, actionlint, zizmor) so downstream repositories can invoke a single maintained workflow instead of copying multiple files.

Changes:

• Adds a reusable Scan workflow callable via workflow_call.
• Implements four scan/lint jobs using digest-pinned container images.
• Standardizes checkout behavior (pinned actions/checkout, persist-credentials: false, full history where required).

Suppressed comments (1)

.github/workflows/scan.yml:79

• The zizmor container is currently given write access to the checked-out repository. Since this job only audits the workflow files, prefer a read-only bind mount to prevent accidental or malicious modifications to the workspace.

          docker run --rm -e GH_TOKEN -v "$PWD:/repo" \
            ghcr.io/zizmorcore/zizmor@sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284 \
            /repo # 1.29.0

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.