chore: add OpenSSF readiness baseline

[seonghobae]

Summary

• add missing OpenSSF Scorecard workflow/security/dependency metadata where needed
• enable repository-level OSSF Best Practices prerequisites without changing product code
• keep existing source code and CI implementation unchanged

Notes

This PR is part of the ContextualWisdomLab non-fork repository OpenSSF readiness sweep. Public repositories will be registered on bestpractices.dev after the baseline metadata is available on the default branch.

[seonghobae]

Closing this as superseded rather than merging a duplicate Scorecard workflow. The current branch now fails the repo supply-chain gate because .github/workflows/scorecard-analysis.yml checkout lacks the required step-level GIT_CONFIG_* init.defaultBranch guard, and the repository already has the hardened .github/workflows/ossf-scorecard.yml path. The OpenSSF Best Practices gap remains tracked in PR #524 and requires updating project 13428 on bestpractices.dev, not this duplicate workflow.

[Copilot]

Pull request overview

Adds an OpenSSF Scorecard GitHub Actions workflow intended to support repository “readiness baseline” metadata without modifying product/runtime code.

Changes:

• Introduces a new .github/workflows/scorecard-analysis.yml workflow to run ossf/scorecard-action on develop pushes and a weekly schedule.
• Publishes Scorecard results and attempts to upload SARIF output to GitHub Code Scanning.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[opencode-agent]

OpenCode Review Overview

• Head SHA: 43cf636260ac87b175681039fa185c090edb3497
• Workflow run: 28569594157
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: scorecard-analysis.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: scorecard-analysis.yml"]
  R1 --> V1["actionlint plus required checks"]

Loading