docs: add badge row, CodeQL, Scorecard, CITATION.cff and llms.txt

.github/workflows/codeql.yml

@@ -0,0 +1,46 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write # Upload CodeQL results for this job only.
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, rust, actions]
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Initialise CodeQL
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/scorecard.yml

@@ -0,0 +1,39 @@
+name: Scorecard
+
+# No push trigger: the weekly run on main publishes the results, so rescanning
+# after every merge only repeated it.
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "35 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write # Upload Scorecard results to code scanning.
+      id-token: write # Publish results for the public Scorecard badge.
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload results to code scanning
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        with:
+          sarif_file: results.sarif

CITATION.cff

@@ -0,0 +1,24 @@
+cff-version: 1.2.0
+message: "If you use this work, cite it with this metadata and the release tag or commit you used."
+title: "Industrious"
+type: software
+authors:
+  - name: "EquityBot"
+abstract: "Ask ChatGPT, or the OpenAI or Azure OpenAI API, about your source files from a CLI or MCP server, and keep each answer as a durable session. A Rust port of Calvino."
+repository-code: "https://github.com/EquityBot/Industrious"
+license-url: "https://github.com/EquityBot/Industrious/blob/main/LICENSE"
+keywords:
+  - azure-openai
+  - chatgpt
+  - cli
+  - developer-tools
+  - mcp
+  - openai
+  - rust
+references:
+  - type: software
+    title: "Oracle"
+    authors:
+      - family-names: Steinberger
+        given-names: Peter
+    repository-code: "https://github.com/steipete/oracle"

README.md

@@ -7,6 +7,14 @@
   </picture>
 </p>
 
+<div align="center">
+
+[![tests](https://img.shields.io/github/actions/workflow/status/EquityBot/Industrious/ci.yml?branch=main&label=tests&labelColor=000000&style=flat)](https://github.com/EquityBot/Industrious/actions/workflows/ci.yml) [![CodeQL](https://img.shields.io/github/actions/workflow/status/EquityBot/Industrious/codeql.yml?branch=main&label=CodeQL&labelColor=000000&style=flat)](https://github.com/EquityBot/Industrious/actions/workflows/codeql.yml)<br>
+[![OpenSSF Scorecard](https://img.shields.io/ossf-scorecard/github.com/EquityBot/Industrious?label=Scorecard&labelColor=000000&style=flat)](https://scorecard.dev/viewer/?uri=github.com/EquityBot/Industrious)<br>
+[![rust: 1.99+](https://img.shields.io/badge/rust-1.99%2B-66023C?labelColor=000000&style=flat&color=66023C)](https://www.rust-lang.org/) [![licence: FSL-1.1-ALv2](https://img.shields.io/badge/licence-FSL--1.1--ALv2-66023C?labelColor=000000&style=flat&color=66023C)](LICENSE)
+
+</div>
+
 Industrious sends a question and the source files you choose to ChatGPT, or to the OpenAI or Azure OpenAI API, and saves the answer as a durable session. It runs as a CLI (`industrious`) and a stdio MCP server (`industrious-mcp`) on Windows and Linux.
 
 It is a Rust port of Calvino, a maintained fork of [Oracle](https://github.com/steipete/oracle) by Peter Steinberger.

llms.txt

@@ -0,0 +1,23 @@
+# Industrious
+
+> A CLI and stdio MCP server that sends a question and chosen source files to ChatGPT,
+> or to the OpenAI or Azure OpenAI API, and saves each answer as a durable session.
+> Windows and Linux only; model labels in ChatGPT do not prove which backend model answered.
+
+Version 0.1.0 (unreleased). Needs Rust 1.99 or later; install from a checkout with
+`cargo install --locked --path .`. Browser runs also need Google Chrome.
+
+## Start
+
+- [README](https://github.com/EquityBot/Industrious#readme): install, use, settings and known limitations.
+- [SECURITY.md](https://github.com/EquityBot/Industrious/blob/main/SECURITY.md): what Industrious can reach and how to report a vulnerability.
+
+## Docs
+
+- [CHANGELOG.md](https://github.com/EquityBot/Industrious/blob/main/CHANGELOG.md): changes in each release.
+- [NOTICE](https://github.com/EquityBot/Industrious/blob/main/NOTICE): licence terms and Oracle's retained MIT notice.
+
+## Related
+
+- [EquityBot](https://github.com/EquityBot): other EquityBot tools.
+- [Oracle](https://github.com/steipete/oracle): the upstream project Calvino, and through it Industrious, derives from.