chore: activate security-scan with xAI Grok (grok-build-0.1) using provided key via secret

.github/security-scan.yml

@@ -3,8 +3,10 @@
 version: 1
 
 llm:
-  provider: openai   # openai | anthropic | azure | google | custom
-  model: gpt-4o      # or claude-3-5-sonnet-20241022, gemini-1.5-pro, etc.
+  provider: custom   # openai | anthropic | azure | google | custom
+  model: grok-build-0.1
+  # For xAI Grok: base url is passed via action input or here if using openai provider with custom endpoint
+
 
 policy:
   block_on: high            # critical | high | medium | low | none

.github/workflows/security-scan.yml

@@ -21,7 +21,10 @@ jobs:
         uses: ./   # for local testing; in real use: your-org/security-scan@v1
         with:
           llm-api-key: ${{ secrets.LLM_API_KEY }}
+          llm-provider: custom
+          llm-model: grok-build-0.1
+          llm-base-url: https://api.x.ai/v1
           # github-token: ${{ secrets.GITHUB_TOKEN }}  # default is sufficient
-          # block-on: critical
-          # llm-provider: anthropic
-          # llm-model: claude-3-5-sonnet-20241022
+          # block-on: high
+          # To relax for testing: block-on: none
+