Add prodsec workflow

[rlieberman-splunk]

No description provided.

[Copilot]

Pull request overview

This PR adds a new GitHub Actions workflow for FOSSA open source scanning to enhance the repository's product security (prodsec) capabilities. The workflow integrates with Splunk's centralized OSS scanning infrastructure by calling a reusable workflow from the splunk/oss-scanning repository.

Key Changes:

• Adds FOSSA OSS scanning workflow that runs on pull requests and pushes to main branch
• Integrates with external reusable workflow from splunk/oss-scanning repository
• Inherits secrets for authentication with FOSSA service

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The workflow is missing a permissions declaration. All other workflows in this repository that call reusable workflows or perform security scanning explicitly define permissions (e.g., main.yml, scorecard.yml, codeql-analysis.yml).

Without explicit permissions, this workflow defaults to read-write for all scopes, which violates the principle of least privilege. Consider adding:

permissions: read-all

or more specific permissions if the FOSSA scan requires write access to certain scopes (check the splunk/oss-scanning documentation for requirements).

[coveralls]

Pull Request Test Coverage Report for Build 19578507505

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 36.822%

---

Totals
Change from base Build 19494067647:	0.0%
Covered Lines:	2336
Relevant Lines:	6344

---

💛 - Coveralls