ci: add Obfuscan workflow for pull requests

Author: VisualBean

.github/workflows/ci.yml

@@ -14,6 +14,24 @@ on:
       - '!**/*.md'
   workflow_dispatch:
 jobs:
+  obfuscan:
+    if: github.event_name == 'pull_request'
+    name: Obfuscan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: write
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Scan PR diff
+      uses: ByteBardOrg/obfuscan-action@v1
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        fail-on: block
+
   build:
 
     runs-on: ${{ matrix.os }}