chore: add SCA scan workflow

.github/workflows/sca.yml

@@ -0,0 +1,36 @@
+name: SCA Scan
+
+# Example: invoke the reusable sca-scan workflow from auth0/devsecops-tooling.
+# Reusable workflows are called at job level via `uses:`.
+# Copy this job block into your .github/workflows/ file.
+#
+# Required org secrets (configured at org level in auth0/):
+#   SNYK_TOKEN            — Snyk organisation token
+#   SIGNAL_HANDLER_TOKEN  — scan-service telemetry auth
+#   SIGNAL_HANDLER_DOMAIN — scan-service endpoint domain
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  # ── SCA / Snyk scan via reusable workflow ───────────────────────────────────
+  sca:
+    uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@e29f26478db18ff0bcbe4bc447a8fbd54fbeec9e
+    with:
+      # All inputs are optional — defaults shown. Uncomment and override as needed.
+      # node-version:     '16'
+      # java-version:     '11'
+      # go-version:       '1.22'
+      # python-version:   '3.10'
+      # ruby-version:     '4.0'
+      # php-version:      '8.5'
+      # dotnet-version:   '6'
+      # dotnet-install-dir: '/usr/share/dotnet/'
+      # snyk-version:     'v1.1292.0'
+      # additional-arguments: ''   # extra Snyk CLI flags, e.g. '--severity-threshold=high'
+      # pre-scan-commands:    ''   # shell commands to run before Snyk (e.g. 'npm ci')
+      # runner:           'ubuntu-latest'
+    secrets: inherit