Fix OSV-Scanner workflow to use reusable workflows

Split into PR scan and scheduled scan workflows using the official
google/osv-scanner-action reusable workflow pattern.

Author: nthmost

.github/workflows/osv-scanner-scheduled.yml

@@ -0,0 +1,16 @@
+name: OSV-Scanner Scheduled Scan
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # Weekly Monday 6am UTC
+  push:
+    branches: [main]
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  scan-scheduled:
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.3"

.github/workflows/osv-scanner.yml

@@ -1,33 +1,16 @@
-name: OSV-Scanner Vulnerability Scan
+name: OSV-Scanner PR Scan
 
 on:
   pull_request:
     branches: [main]
-  push:
+  merge_group:
     branches: [main]
-  schedule:
-    - cron: '0 6 * * 1'  # Weekly Monday 6am UTC
-  workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
 jobs:
-  osv-scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run OSV-Scanner
-        uses: google/osv-scanner-action/osv-scanner-action@v2
-        with:
-          scan-args: |-
-            --recursive
-            ./
-
-      - name: Upload SARIF
-        if: always()
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: results.sarif
+  scan-pr:
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.3"