ci: add plumber workflow security check

Scans the workflows on each push to main and on pull requests, and
fails when something regresses: an unpinned action, a job without a
permissions block, an archived dependency, a known CVE. The config
is a small overlay that inherits the CLI's built-in baseline and
turns off one control this repo cannot satisfy yet, with a comment
saying why. Each run publishes the score to score.getplumber.io,
shown as a badge in the README.

Author: Totara-thib

.github/workflows/plumber.yml

@@ -0,0 +1,31 @@
+name: Plumber
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  plumber:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+      # Needed by score-push to publish the score for the README badge.
+      id-token: write
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      - uses: getplumber/plumber@7ad9d267ee5a00163cec9e5c749a088d5f565167 # v0.4.26
+        with:
+          # Code scanning upload needs security-events write, which PRs
+          # from forks do not get. The report stays available as a
+          # workflow artifact there.
+          upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }}
+          # Publishes the score to score.getplumber.io, which feeds the
+          # badge in the README. A failed push never fails the run.
+          score-push: true

.plumber.yaml

@@ -0,0 +1,14 @@
+# Plumber overlay: inherits every control from the CLI's built-in
+# baseline, only the differences for this repo are written here.
+# Run 'plumber config resolve' to see the full effective config.
+extends: plumber:default
+version: "2.0"
+
+github:
+  controls:
+    # Off for now: the release jobs restore the npm cache through
+    # setup-node on release triggers. Scoping the cache key to the
+    # release ref (or skipping the cache on publish) is a good
+    # follow-up, but it is its own change.
+    releaseWorkflowsMustNotRestoreUntrustedCache:
+      enabled: false

README.md

@@ -1,6 +1,7 @@
 # React Components for the Google Maps JavaScript API
 
 [![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/visgl/react-google-maps/tree/main/LICENSE)
+[![Plumber Score](https://score.getplumber.io/github.com/visgl/react-google-maps.svg)](https://score.getplumber.io/github.com/visgl/react-google-maps)
 
 This is a TypeScript / JavaScript library to integrate the Maps JavaScript API
 into your React application.