ci: probe the OSS Scanner image (temporary)

Author: datlechin

.github/workflows/oss-scanner-probe.yml

@@ -0,0 +1,47 @@
+name: OSS Scanner probe
+on:
+  push:
+    branches: [chore/oss-scanner-probe]
+permissions:
+  contents: read
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Make room, as anthropics/oss-scanner build.yaml does
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
+          df -h /
+      - name: Prepare tools/check
+        run: |
+          git clone --depth 1 https://github.com/anthropics/oss-scanner.git
+          mkdir -p oss-scanner/projects/tablepro
+          printf '%s\n' \
+            "repo: https://github.com/TableProApp/TablePro#${GITHUB_REF_NAME}" \
+            "primary_contact: hello@tablepro.app" \
+            "homepage: https://tablepro.app" \
+            "dockerfile: .oss-scanner/Dockerfile" \
+            "threat_model: .oss-scanner/threat_model.md" > oss-scanner/projects/tablepro/project.yaml
+          python3 -c 'import yaml' || pip install pyyaml
+      - name: tools/check --no-shell
+        run: |
+          ( while sleep 60; do echo "disk: $(df -h / | awk 'NR==2{print $3" used, "$4" free"}')"; done ) &
+          start=$(date +%s)
+          cd oss-scanner && python3 tools/check --no-shell tablepro
+          echo "build seconds: $(( $(date +%s) - start ))"
+          df -h /
+          docker system df
+      - name: Offline checks, agent limits
+        run: |
+          cat > probe.sh <<'EOF'
+          set -u
+          du -sh /src/linux/_build/cargo-target /src/linux/_build/cargo-home /src/.oss-scanner/swift/.build 2>/dev/null
+          echo "== cargo offline after an edit"
+          cd /src/linux && touch crates/core/src/lib.rs
+          time meson devenv -C _build cargo test --locked -p tablepro-core 2>&1 | grep -E '^test result|Compiling tablepro' | head -5
+          echo "== swift offline after an edit"
+          cd /src/.oss-scanner/swift && touch Sources/TableProSQLGrammar/SqlLexer.swift
+          swift test 2>&1 | grep -E 'Test run with|error:' | head -5
+          EOF
+          docker run --rm --network none --cpus 2 --memory 8g -v "$PWD/probe.sh:/probe.sh:ro" -w /src oss-scanner-check/built:tablepro bash /probe.sh