feat(security): add GHAS-free baseline caller

.github/workflows/security-baseline.yml

@@ -0,0 +1,27 @@
+name: Security baseline
+
+# Required caller emits status on every pull request; scanner scope belongs in reusable inputs.
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    uses: Staros-Labs/infra/.github/workflows/reusable-security-gitleaks.yml@07dce02accd706afbcb8a8b420de0979d3f03364
+    with:
+      report_only: true
+      scan_history: false
+    permissions:
+      contents: read
+
+  osv:
+    uses: Staros-Labs/infra/.github/workflows/reusable-security-osv.yml@07dce02accd706afbcb8a8b420de0979d3f03364
+    with:
+      report_only: true
+    permissions:
+      contents: read

scripts/test_security_baseline_workflow.py

@@ -0,0 +1,25 @@
+from pathlib import Path
+import unittest
+
+
+WORKFLOW = Path(__file__).parents[1] / ".github/workflows/security-baseline.yml"
+
+
+class SecurityBaselineWorkflowTests(unittest.TestCase):
+    def test_caller_uses_pinned_ghas_free_scanners(self) -> None:
+        text = WORKFLOW.read_text(encoding="utf-8")
+        self.assertIn("pull_request:", text)
+        self.assertIn("push:\n    branches: [main]", text)
+        self.assertIn("workflow_dispatch:", text)
+        self.assertIn("Staros-Labs/infra/.github/workflows/reusable-security-gitleaks.yml@07dce02accd706afbcb8a8b420de0979d3f03364", text)
+        self.assertIn("Staros-Labs/infra/.github/workflows/reusable-security-osv.yml@07dce02accd706afbcb8a8b420de0979d3f03364", text)
+        self.assertEqual(text.count("report_only: true"), 2)
+        self.assertNotIn("github/codeql-action", text)
+        self.assertNotIn("security-events", text)
+        self.assertNotIn("upload-sarif", text)
+        self.assertNotIn("paths:", text)
+        self.assertNotIn("paths-ignore:", text)
+
+
+if __name__ == "__main__":
+    unittest.main()