ci: feed osv-scanner CVE findings to code scanning via MegaLinter SARIF

.github/workflows/megalinter.yml

@@ -0,0 +1,51 @@
+name: MegaLinter
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  megalinter:
+    name: Security (osv-scanner) → code scanning
+    runs-on: ubuntu-latest
+    permissions:
+      # Required for github/codeql-action/upload-sarif to write the findings
+      # into Security > Code scanning.
+      security-events: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: Run MegaLinter
+        if: ${{ !cancelled() }}
+        uses: oxsecurity/megalinter/flavors/ci_light@ef3e84b8b836d76db562d0f3ed7da61e8fd538bc # v9.6.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Surface MegaLinter's aggregated SARIF into Security > Code scanning.
+      # Best-effort: a missing/empty SARIF, or a forked PR without code-scanning
+      # write access, must not fail the job.
+      - name: Upload MegaLinter SARIF to code scanning
+        if: ${{ !cancelled() }}
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          sarif_file: megalinter-reports/megalinter-report.sarif
+          category: mega-linter
+
+      - name: Archive MegaLinter reports
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: megalinter-reports
+          path: |
+            megalinter-reports
+            mega-linter.log

.mega-linter.yml

@@ -0,0 +1,27 @@
+DEFAULT_BRANCH: main
+
+# MegaLinter runs here purely as a SARIF security feed into GitHub code
+# scanning, not as a general linter: style and correctness are already owned
+# by the repo's turbo/eslint/prettier/cargo (clippy, fmt), typos, tombi and
+# cargo-shear stack. Restricting to a single linter keeps MegaLinter from
+# duplicating or fighting that stack.
+ENABLE_LINTERS: REPOSITORY_OSV_SCANNER
+
+# osv-scanner (dependency CVE scanning) is project-scope, so it walks the whole
+# tree regardless of the changed-file filter. VALIDATE_ALL_CODEBASE keeps its
+# behaviour identical on push and on PRs.
+VALIDATE_ALL_CODEBASE: true
+
+# osv-scanner findings are advisory: surface transitive-dependency CVEs in the
+# Security tab, but never gate a PR on them (a fix often needs an upstream bump
+# we don't control).
+REPOSITORY_OSV_SCANNER_DISABLE_ERRORS: true
+
+# Aggregate osv-scanner's output into a single
+# `megalinter-reports/megalinter-report.sarif`, which the workflow uploads to
+# the GitHub code-scanning UI via github/codeql-action/upload-sarif.
+SARIF_REPORTER: true
+
+FILEIO_REPORTER: false
+FLAVOR_SUGGESTIONS: false
+SHOW_ELAPSED_TIME: true