ci: Add code-scan workflow

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

Author: stefanprodan

.github/workflows/backport.yaml

@@ -7,6 +7,6 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.3
+    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.4
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/code-scan.yaml

@@ -0,0 +1,15 @@
+name: code-scan
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+jobs:
+  analyze:
+    permissions:
+      contents: read
+      security-events: write
+    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.0.4
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+      fossa-token: ${{ secrets.FOSSA_TOKEN }}

.github/workflows/labels-sync.yaml

@@ -11,4 +11,4 @@ jobs:
     permissions:
       issues: write
       contents: read
-    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.1
+    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.4

README.md

@@ -1,5 +1,6 @@
 # source-watcher
 
+[![fossa](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher.svg?type=small)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher?ref=badge_small)
 [![test](https://github.com/fluxcd/source-watcher/workflows/e2e/badge.svg)](https://github.com/fluxcd/source-watcher/actions)
 [![report](https://goreportcard.com/badge/github.com/fluxcd/source-watcher)](https://goreportcard.com/report/github.com/fluxcd/source-watcher)
 [![license](https://img.shields.io/github/license/fluxcd/source-watcher.svg)](https://github.com/fluxcd/source-watcher/blob/main/LICENSE)