ci: feed osv-scanner CVE findings to code scanning via MegaLinter SARIF

[ChipWolf]

What

Adds MegaLinter to CI, scoped purely as a SARIF security feed into GitHub Security → Code scanning:

• .mega-linter.yml — ENABLE_LINTERS: REPOSITORY_OSV_SCANNER runs only osv-scanner (dependency CVE scanning). SARIF_REPORTER: true aggregates its output to megalinter-reports/megalinter-report.sarif. REPOSITORY_OSV_SCANNER_DISABLE_ERRORS: true keeps findings advisory.
• .github/workflows/megalinter.yml — runs MegaLinter on PRs and pushes to main, then uploads the SARIF via github/codeql-action/upload-sarif under the mega-linter category.

Why

Surfaces known CVEs in our dependency tree in the repo's Security tab, without touching the existing lint stack.

Reviewer notes

• Deliberately security-only. Style/correctness linting stays owned by the existing turbo/eslint/prettier, cargo (clippy, fmt), typos, tombi and cargo-shear stack. ENABLE_LINTERS is an allowlist, so MegaLinter runs osv-scanner and nothing else — no duplication or conflict with that stack.
• Non-blocking by design. osv-scanner errors are disabled and the SARIF upload is continue-on-error, so transitive-dependency CVE noise never gates a PR, and forked PRs without code-scanning write access won't fail the job. Both the linter and upload steps use if: ${{ !cancelled() }} so findings still upload.
• Requires code scanning enabled on the repo. If it isn't (e.g. a private repo needing GitHub Advanced Security), the upload silently no-ops and CI stays green, but nothing appears in the Security tab until it's turned on in repo settings.
• All actions are SHA-pinned with version comments, matching repo convention: MegaLinter v9.6.0, codeql-action/upload-sarif v4.37.1, upload-artifact v7.0.1, checkout v6.0.2.

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only addition with read-mostly permissions, non-blocking CVE reporting, and no application or auth logic changes.

Overview
Adds a MegaLinter CI path whose only job is to run osv-scanner and push dependency CVE results into GitHub Security → Code scanning, without changing the repo’s existing lint stack.

.mega-linter.yml turns on only REPOSITORY_OSV_SCANNER, scans the full tree on every run, emits aggregated SARIF, and keeps findings advisory (REPOSITORY_OSV_SCANNER_DISABLE_ERRORS: true) so CVEs don’t fail builds.

.github/workflows/megalinter.yml runs on PRs and main pushes: checkout → MegaLinter ci_light → best-effort SARIF upload (continue-on-error, mega-linter category) → artifact archive of reports and logs. Job-level security-events: write is scoped to the upload step’s needs.

^{Reviewed by Cursor Bugbot for commit 5d9ab05. Bugbot is set up for automated code reviews on this repo. Configure here.}