Thibaud-Vdb 1d553ff5ee ci: add plumber to watch workflow security ...

Runs on pushes to main and on pull requests. The config starts from
the generated defaults and is scoped to this repo: the few controls
that are off carry a note explaining why and what would let them
come back on.

Reports are uploaded to code scanning, except on PRs from forks
where the token cannot write security events. Each run on main also
publishes the score through OIDC, which feeds the live badge added
to the README next to the existing ones.

2026-07-20 15:12:58 +02:00

..

actions

ci: pin github actions to commit shas

2026-07-20 14:56:59 +02:00

workflows

ci: add plumber to watch workflow security

2026-07-20 15:12:58 +02:00