ci: call shared workflows from infra

[listepo]

What

Adds .github/workflows/pipeline.yml, a thin caller of the shared
listepo/infra pipeline (CodeQL + Semgrep + Snyk in
parallel behind pipeline / gate).

• Pinned: listepo/infra/.github/workflows/pipeline.yml@189816ac5a375e18e0235044970efcbc40e3cabd
• rust: false: the Rust crates are covered by the local ci.yml. Swift/Kotlin need a build; Python is vendored WAMR scripts only.
• CodeQL languages: ["actions", "c-cpp", "javascript-typescript", "rust"] (build-mode none, security-and-quality).
• Caller permissions: contents: read, security-events: write, actions: read.
• Secrets passed explicitly: SNYK_TOKEN (optional; Snyk skips itself without it).

What stays local

ci.yml (including its Codecov job) and code-review.yml. .github/dependabot.yml is untouched. No workflow was removed.

Supersedes #14, #16, #17.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: listepo/cross-code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 65a78f3c-f474-4efd-9d20-edb16ba7a53f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}