ci: add blackduck oss scan

.github/workflows/open-source-security.yml

@@ -0,0 +1,26 @@
+name: Open Source Security
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "12 3 * * *"
+  workflow_dispatch:
+
+jobs:
+  piper-oss:
+    name: 'Security'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: detectExecuteScan
+        uses: SAP/[email protected]
+        with:
+          step-name: detectExecuteScan
+          flags: '--token ${{ secrets.DETECT_TOKEN }}'
+
+

.pipeline/config.yml

@@ -0,0 +1,16 @@
+general:
+  owner: SAP
+  repository: ui5-webcomponents-react
+  buildTool: yarn
+steps:
+  detectExecuteScan:
+    serverUrl: 'https://sap.blackducksoftware.com'
+    projectName: 'ui5-webcomponents-react'
+    groups:
+      - 'ui5-webcomponents-react'
+    npmDependencyTypesExcluded: ['DEV']
+    useDetect9: true
+    excludedPackageManagers:
+      - 'LERNA'
+    customEnvironmentVariables:
+      - 'DETECT_YARN_DEPENDENCY_TYPES_EXCLUDED=NON_PRODUCTION'