Harden release trust, CI and supply-chain evidence

[cucuwang]

Summary

Hardens CI, repository checks and the next-release path without changing scoring, CLI, API, JSON or composite Action behavior. Version remains 0.9.0; publication and merge remain separate maintainer decisions.

Implemented

• Pins every workflow and both Action metadata paths to upstream-verified SHAs, uses contents:read by default, scopes write permissions, and disables persisted checkout credentials.
• Reuses the existing CI gates and check names. The manual release workflow defaults to non-publishing and requires exact source, signed tag, package identity and unpublished-version preflight.
• Exports the exact validated tarball with SHA256SUMS, an SPDX production SBOM, GitHub tarball attestation support and npm provenance. Release ordering stages a draft, uploads assets, publishes npm, then finalizes the release.
• Keeps the maintainer runbook separate from concise public v0.10 release notes.
• Requires a present, non-empty README inside the verified tarball. Post-publication UI readback remains separate from the registry metadata field.
• Adds Dependabot, JavaScript/TypeScript and Actions CodeQL, Dependency Review, OpenSSF Scorecard, CODEOWNERS and contribution templates.
• Documents applied repository gates, remaining release settings, verified pins, Action reproducibility and OpenSSF Passing gaps. Bundling follow-up remains in Evaluate a reproducible bundled Action while preserving package-spec #20.

Repository gates applied

• Dependency graph and vulnerability alerts enabled; Dependency Review passes without suppression.
• Dependabot security updates and private vulnerability reporting enabled.
• Active main-required-checks ruleset 22637595 requires a pull request, resolved conversations, an up-to-date branch and all eight CI, Dependency Review and CodeQL contexts. No bypass actors.
• Existing secret scanning, push protection, main force-push/deletion protection and release-tag protection remain enabled.

Validation

Local release:check passed 242 tests, TypeScript build, Action contract, high-level npm audit with 0 vulnerabilities, package contents, non-empty packaged README, clean consumer installation, three CLI aliases and report contracts. SPDX/checksums and the non-publishing verified-tarball preview passed.

Final head 09f04a9:

• CI 34349533443 passed Node 22/24, byte-identical candidates, README commands and both Action paths.
• CodeQL 34349533421 passed JavaScript/TypeScript and Actions.
• Dependency Review 34349533418 passed after the dependency graph was enabled.

Detailed evidence is in docs/trust-hardening-validation.md.

Deferred release gates

• Configure npm Trusted Publisher, the npm-release environment, release immutability and signing identity before the first authorized v0.10 release.
• Enable RELEASE_ENABLED only after the release checklist and dry run pass.
• OIDC authorization, actual attestation/provenance issuance and immutable-release behavior remain unproven until an authorized release.
• Scorecard public results await the first main run. Add Scorecard and OpenSSF badges only after actual results or award.
• The composite Action still resolves transitive dependencies at runtime; Evaluate a reproducible bundled Action while preserving package-spec #20 tracks the measured bundle decision.

No credentials, npm publication, production release, tag or merge was created or changed.

For reviewers

Confirm the public release notes stay separate from maintainer setup and recovery instructions.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.