Add automated security scanning workflows #3

	name: security

	on:
	push:
	branches:
	- main
	pull_request:
	schedule:
	# Run every day at 10:00 UTC (6:00 AM ET / 3:00 AM PT)
	- cron: "0 10 * * *"
	workflow_dispatch:

	permissions:
	contents: read

	# Cancel in-progress runs for pull requests when developers push
	# additional changes
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	codeql:
	name: CodeQL Analysis
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	actions: read
	contents: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Setup Go
	uses: actions/setup-go@v5
	with:
	go-version-file: "go.mod"

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v3
	with:
	languages: go

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v3
	with:
	category: "/language:go"

	trivy-repo:
	name: Trivy Filesystem Scan
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	contents: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Run Trivy vulnerability scanner in repo mode
	uses: aquasecurity/[email protected]
	with:
	scan-type: "fs"
	scan-ref: "."
	format: "sarif"
	output: "trivy-results.sarif"
	severity: "LOW,MEDIUM,HIGH,CRITICAL"
	scanners: "vuln,secret,misconfig"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "trivy-results.sarif"
	category: "Trivy-Filesystem"

Provide feedback