Chore: Strip template scaffolding, rebrand repo

[ModeSevenIndustrialSolutions]

Chore: Strip template scaffolding, rebrand repo

Phase 1 of the migration bringing the security lanes out of lfit/releng-reusable-workflows. This clears the ground; no lanes land here yet.

This repository was created from workflows-template, whose generic build/test/release skeletons don't apply to a scanning repository.

Removed

What	Why
build-test.yaml, build-test-release.yaml, merge.yaml	Template skeletons for build/release pipelines — not what this repo does
examples/build-test/, examples/build-test-release/, examples/merge/	Their six caller examples
testing.yaml	Existed solely to exercise those skeletons, and referenced ./.github/workflows/build-test.yaml — it would break on deletion

On testing.yaml: there's nothing to self-test until a lane exists, and leaving a workflow pointing at a deleted file would fail actionlint and error in the Actions UI. Phase 2 reinstates it alongside the CLM lane, wired to a real fixture by local ./ path. Repo-local CI coverage continues meanwhile via the org-wide required workflows (zizmor, package hardening, semantic PR, SHA-pin audit).

Kept: clear-action-cache, openssf-scorecard, release-drafter, tag-push — this repository's own CI, not scaffolding.

Net: −3,278 / +323 lines.

Rewritten

README.md — the six planned lanes and their status; how lanes compose at the caller rather than by nesting across repositories; the per-lane Gerrit posture; the shared conventions.

docs/BRIEF.md — the design decisions, now including the three that came out of the Phase 0 audit:

• D8 — openssf-scorecard.yaml cannot support Gerrit. Not a design preference: ossf/scorecard-action restricts which steps may run in its job, and its publish API rejects anything else with HTTP 400. A Gerrit checkout action cannot run there. Recorded so nobody adds Gerrit inputs to that lane in good faith.
• D9 — the zizmor lane must expose persona and min-severity. The source workflow passes neither, so it would silently disagree with both the ruleset PR gate and the SARIF publisher once the org floor moves to informational (.github#133).
• D10 — jordanconway/package-manager-hardening accepted as trusted, with a note to review the pin if the repository relocates.

Also documented: why a dedicated repository (cohesion, not churn — splitting actually removes the ./ escape hatch), the java_version collision between CLM and java-workflows, and the pinning policy including the warning that .github has shipped three consecutive mis-tagged releases, so allow-list content needs verifying at the ref rather than trusting the tag.

Validation

• pre-commit run --all-files — all hooks pass (yamllint, markdownlint, actionlint, write-good, reuse lint, codespell, workflow schema validation, ReadTheDocs config)
• zizmor --persona auditor .github/workflows/ — zero findings

write-good caught several passive-voice constructions in my first draft of the README; reworded rather than suppressed.

Next

Phase 2 ports sonatype-lifecycle.yaml (the CLM lane), reinstates testing.yaml, and adds the first examples/ pair.

[Copilot]

Pull request overview

Phase 1 of migrating security “lanes” into this repository by removing the inherited workflows-template scaffolding and rebranding the repo/docs to “security-workflows”, while keeping only the repo’s own CI workflows.

Changes:

• Rewrote README.md and docs/BRIEF.md to describe the security-lanes concept, composition model, and migration rationale.
• Removed the template skeleton reusable workflows and their example callers (plus testing.yaml which depended on the removed skeletons).
• Minor cleanup in .github/actionlint.yaml wording.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Rebranded repository and documented planned security lanes, composition model, and conventions
docs/BRIEF.md	Replaced template design brief with security-workflows design decisions and migration rationale
.github/actionlint.yaml	Minor comment wording update
.github/workflows/testing.yaml	Removed self-test workflow that referenced deleted template workflows
.github/workflows/build-test.yaml	Removed template reusable workflow skeleton
.github/workflows/build-test-release.yaml	Removed template reusable workflow skeleton
.github/workflows/merge.yaml	Removed template reusable workflow skeleton
examples/build-test/github.yaml	Removed template caller example
examples/build-test/gerrit.yaml	Removed template caller example
examples/build-test-release/github.yaml	Removed template caller example
examples/build-test-release/gerrit.yaml	Removed template caller example
examples/merge/github.yaml	Removed template caller example
examples/merge/gerrit.yaml	Removed template caller example

Comments suppressed due to low confidence (1)

README.md:90

• The Usage section instructs users to copy callers from examples/, but examples/ has been deleted in this PR. This makes the README’s primary onboarding path a dead link; point users to the current source repo until examples are reintroduced alongside the first lane.

Copy a caller from [`examples/`](examples/) into your project's
`.github/workflows/` directory and replace the placeholder `uses:` SHA
with a pinned release. Each lane ships in two forms:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

README.md:102

• The repository list here uses truncated names (python-, go-, node-), which is ambiguous/inconsistent with the actual repo naming elsewhere (e.g. java-workflows). Use the full repository names for clarity.

Shared with `python-`, `go-`, `node-` and `java-workflows`:

docs/BRIEF.md:155

• This sentence claims "three consecutive mis-tagged releases" but only cites two versions (v0.8.0 and v0.9.0). Either list all three or soften the claim so it matches the evidence given in the text.

Always pin the **commit** SHA, never the annotated tag object. The
`.github` repository has shipped three consecutive mis-tagged releases
(v0.8.0 and v0.9.0 both pointed at commits predating the changes they
advertised), so verify allow-list content by fetching the file at the
ref rather than trusting the tag.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.