fix(security): treat 'no package sources' as pass in osv-scanner (#11)

osv-scanner v2 exits 128 when a target has no package manifests
(e.g. scripts-only repos like resq-software/dev). That's not a failure —
it just means there's nothing to scan. Map 128 → exit 0 and leave all
other exit codes as-is.

Author: WomB0ComB0

.github/workflows/security-scan.yml

@@ -140,7 +140,16 @@ jobs:
         run: |
           set -euxo pipefail
           go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.3.5
-          "$(go env GOPATH)/bin/osv-scanner" scan source --recursive ./
+          # Exit 128 from osv-scanner = "no package sources found"; treat as
+          # success for scripts-only / manifest-free repos.
+          "$(go env GOPATH)/bin/osv-scanner" scan source --recursive ./ || {
+            rc=$?
+            if [ "$rc" -eq 128 ]; then
+              echo "osv-scanner: no package sources in this repo — skipping."
+              exit 0
+            fi
+            exit "$rc"
+          }
 
   # ── Dependency Review (PR only) ───────────────────────────────────────────
   dependency-review: