diff --git a/.github/workflows/code-scan.yml b/.github/workflows/code-scan.yml
new file mode 100644
index 0000000..361a493
--- /dev/null
+++ b/.github/workflows/code-scan.yml
@@ -0,0 +1,18 @@
+name: "Code scanning"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+jobs:
+  gosec:
+    permissions:
+      # Required to upload SARIF files
+      security-events: write
+      # for actions/checkout to fetch code
+      contents: read
+    # call reusable workflow from central '.github' repo
+    uses: open-component-model/.github/.github/workflows/code-scan.yml@main
+    secrets: inherit