From 03becd0bef75eee10152646d3dd4a78efc6d04b5 Mon Sep 17 00:00:00 2001
From: WiderDev <dev@wider.community>
Date: Fri, 24 Jul 2026 05:52:56 +0300
Subject: [PATCH] [ci-templates] Adopt security-scan.yml (WID-928)

Report-only rollout of the shared security-scan.yml reusable workflow
(gitleaks + OSV-Scanner + Semgrep), matching the AQWUM-Core pilot from
WID-824. Non-blocking: fail-on-secrets=false, dependency/sast severity=none.
---
 .github/workflows/security.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..e29697d
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,22 @@
+name: Security Scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: security-scan
+    uses: Wider-Community/ci-templates/.github/workflows/security-scan.yml@main
+    with:
+      # Report-only rollout: visibility first, tighten thresholds once
+      # findings are triaged (WID-928, following the AQWUM-Core pilot in WID-824).
+      fail-on-secrets: false
+      dependency-fail-severity: none
+      sast-fail-severity: none