feat: add Obfuscan workflow for pull requests

Adds a new job named Obfuscan to the CI workflow to scan the pull request diff using the ByteBardOrg/obfuscan-action.
This job runs only when a pull request is opened, and it uses the head SHA of the pull request to check for potential issues in the code changes before the main build proceeds.

Author: VisualBean

.github/workflows/ci.yml

@@ -14,6 +14,23 @@ on:
       - '!**/*.md'
   workflow_dispatch:
 jobs:
+  obfuscan:
+    if: github.event_name == 'pull_request'
+    name: Obfuscan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: write
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Scan PR diff
+      uses: ByteBardOrg/obfuscan-action@v1
+      with:
+        fail-on: block
+
   build:
 
     runs-on: ${{ matrix.os }}