Add Plumber CI/CD compliance scanning to workflows

[dimahc]

Context

Plumber is an open-source CI/CD compliance scanner for GitHub Actions and GitLab CI pipelines. It checks pipelines against security best practices — action pinning, authorized sources, forbidden tags, Docker-in-Docker, hardcoded secrets, etc.

The orange-cloudavenue/cloudavenue-sdk-go repo was scanned on Plumber Radar (https://getplumber.io/radar) and scored D (37.58/100) with 21 high-severity issues across two controls:

• actionPinningResult — actions not pinned to commit SHA
• authorizedActionSourcesResult — actions from unapproved sources

Goal

Add a reusable GitHub Actions workflow (or scheduled job) to the org's centralized workflows that runs Plumber analysis on every push/PR and reports compliance scores. This can be:

1. A new workflow file (e.g., plumber_compliance.yml) that can be composed into consumer repos via workflow_call
2. Or integration into an existing PR checks workflow

What Plumber offers

• Analyze endpoint: POST /radar/api/analyze {projectPath} to trigger a scan
• Status polling: GET /radar/api/analyze/status?pipelineId=<id> to get results
• Report output: compliance score, per-control pass/fail, issue counts by severity

Alternatively, Plumber may offer a GitHub Action or CLI — investigate and use whichever fits best.

Requirements

• Works as a reusable workflow_call action (matching the repo's existing pattern)
• Runs on push to main and on PRs
• Fails/ warns on score below a configurable threshold
• Reports results as a PR comment or check run annotation
• Documented in the repo README

References

• Plumber Radar: https://getplumber.io/radar
• Plumber API: https://getplumber.io/radar/api/
• Existing workflow pattern: .github/workflows/ composable workflow_call actions synced via sync.yml