Add code scanning to CI workflows

.github/workflows/test.yml → .github/workflows/ci.yml

-name: Continuous Integration
+name: CI
 
 on:
   push:
     tags-ignore:
     - 'v*'
     branches:
-    - "**"
+    - "master"
   pull_request:
-  schedule:
-    - cron: '0 0 * * SUN'
+  workflow_call:
+    secrets:
+      GITLEAKS_LICENSE_KEY:
+        required: true
 
 jobs:
   ci:
     uses: smallstep/workflows/.github/workflows/goCI.yml@main
+    with:
+      gitleaks: true
+      codeql: true
+    secrets:
+      GITLEAKS_LICENSE_KEY: ${{ secrets.GITLEAKS_LICENSE_KEY }}

.github/workflows/code-scan-cron.yml

+on:
+  schedule:
+    - cron: '0 0 * * *'
+
+jobs:
+  gitleaks:
+    uses: smallstep/workflows/.github/workflows/gitleaks.yml@main
+    secrets:
+      GITLEAKS_LICENSE_KEY: ${{ secrets.GITLEAKS_LICENSE_KEY }}
+
+  codeql:
+    uses: smallstep/workflows/.github/workflows/codeql-analysis.yml@main