From 14fb309c1fd529c5933a6e11a15c3afb8d689586 Mon Sep 17 00:00:00 2001
From: nir-test-ac <288877708+nir-test-ac@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:29:41 +0530
Subject: [PATCH] chore: add SCA workflow from unified-pipeline-template

---
 .github/workflows/sca.yml | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 .github/workflows/sca.yml

diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml
new file mode 100644
index 0000000000..cde15d8722
--- /dev/null
+++ b/.github/workflows/sca.yml
@@ -0,0 +1,36 @@
+name: SCA Scan
+
+# Example: invoke the reusable sca-scan workflow from auth0/devsecops-tooling.
+# Reusable workflows are called at job level via `uses:`.
+# Copy this job block into your .github/workflows/ file.
+#
+# Required org secrets (configured at org level in auth0/):
+#   SNYK_TOKEN            — Snyk organisation token
+#   SIGNAL_HANDLER_TOKEN  — scan-service telemetry auth
+#   SIGNAL_HANDLER_DOMAIN — scan-service endpoint domain
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  # ── SCA / Snyk scan via reusable workflow ───────────────────────────────────
+  sca:
+    uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@e29f26478db18ff0bcbe4bc447a8fbd54fbeec9e
+    with:
+      # All inputs are optional — defaults shown. Uncomment and override as needed.
+      # node-version:     '16'
+      # java-version:     '11'
+      # go-version:       '1.22'
+      # python-version:   '3.10'
+      # ruby-version:     '4.0'
+      # php-version:      '8.5'
+      # dotnet-version:   '6'
+      # dotnet-install-dir: '/usr/share/dotnet/'
+      # snyk-version:     'v1.1292.0'
+      # additional-arguments: ''   # extra Snyk CLI flags, e.g. '--severity-threshold=high'
+      # pre-scan-commands:    ''   # shell commands to run before Snyk (e.g. 'npm ci')
+      # runner:           'ubuntu-latest'
+    secrets: inherit