ci: scan repo with Plumber Score action

[thomasboni]

What

Adds .github/workflows/plumber.yml so this repo runs the official Plumber Score GitHub Action on itself (dogfooding). Triggers on push/PR to main and workflow_dispatch.

Why

The repo already ships a .plumber.yaml config but nothing was actually running Plumber in CI. This wires up the latest action release.

Details

• Uses getplumber/plumber@303ade500dee048f997bba7934dd54628bf08a3a (v0.3.74), the current Marketplace "Plumber Score" action.
• Pinned by commit SHA with a version comment, satisfying the repo's own actionsMustBePinnedByCommitSha policy in .plumber.yaml (only actions/github owners are exempt).
• permissions: security-events: write so the action can upload its SARIF to GitHub Code Scanning.
• Auto-detects the existing .plumber.yaml and uses the default threshold: 100.

Optional follow-ups

• Enable the public A–E score badge via score-push: true + id-token: write (off by default).
• Add Dependabot with version-update-strategy: sha-and-version to keep the pin fresh.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Adds CI-only automation with read contents and SARIF upload permissions; no application or runtime code changes.

Overview
Adds a Plumber GitHub Actions workflow so the repo’s existing .plumber.yaml policy is enforced in CI on every push and pull request to main, plus manual workflow_dispatch.

The job checks out the repo and runs getplumber/plumber pinned to commit SHA v0.3.74, with security-events: write so results can land in GitHub Code Scanning. Workflow concurrency cancels in-flight runs for the same ref.

^{Reviewed by Cursor Bugbot for commit e730d2b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.