feat(security): scan the engine, which has never been scanned

[rldyourmnd]

This repository has no code scanning. Not stale, not partial — GET /code-scanning/analyses returns no analysis found and default setup is not-configured. Go is 97% of the tree: the compiler, the projection engine, the release builder, and the trust and provenance code every other repository in the estate relies on to be correct.

It is not alone

Repository	Code	Scanned
github-device-sync	Go 97%	nothing
github-actions	Go 95%	nothing
ci-workflows	Python 98%	actions, python
cd-workflows	Python 75%	nothing
macos-ubuntu-bootstrap	Python 62%	actions only — NDDev-OpenNetwork/macos-ubuntu-bootstrap#7
agent-runtime	Go 100%	nothing

Four of six have never been scanned, and they are the entire Go control plane. The republication carried the code to the new organisation and left the scanning behind. Nothing failed, because nothing was watching — the same shape as the archived-lineage findings in #22, #23 and macos-ubuntu-bootstrap#7.

Secret scanning and push protection were also disabled on all six; both are free for public repositories and are now on.

The change

Advanced setup, not default setup: the caller is pinned, reviewable in a diff, and names its runner. languages: '["go","actions"]' with autobuild: true — the reusable sets Go up from go.mod when the language is go.

Pinned to 0.1.4 at the commit that tag actually resolves to. Worth stating because the estate's twelve other call sites pin an untagged 2026-08-15 commit while claiming version 0.13.3, which has never existed — NDDev-OpenNetwork/ci-workflows#45.

Deliberately left out of required_contexts. A check that has never produced a green run should not gate merges on the pull request introducing it. Promote it once it has passed on main.

Verification

The repository's own commands:

• scripts/validate_shell.sh → PASS, 8 scripts, shellcheck 0.11.0
• go vet ./... → clean
• go build -trimpath ./core/cmd/gds → ok
• go test ./... → every package ok
• actionlint 1.7.12 → clean

And confirmed this does not trip #24: .github is not in developmentBundleSourcePaths, and gds context on this branch reports no GDS_CONTEXT_POLICY_SOURCE_DIGEST_MISMATCH — only the pre-existing GDS_CONTEXT_ESTATE_NOT_REGISTERED.

Expect first-run findings. That is the point.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.