[EquityBot]

Summary

Adds scorecard.yml, copied from Alcuin, so the OpenSSF Scorecard API publishes a result for this repository (it currently returns 404). Its upload-sarif pin uses the codeql-action commit codeql.yml already uses.

claude.yml gains a top-level permissions: {}, matching the other 9 workflows; its job keeps its own grants.

Evidence

• python -m unittest tests.test_ci_installs: 7 passed (full-SHA pins, Dependabot coverage).
• actionlint: clean on every workflow.
• zizmor 1.31.1: scorecard.yml no findings; claude.yml no longer reports excessive-permissions, other findings unchanged from main.

Merge danger

Door: two-way. Blast radius: CI

Scorecard runs weekly, on dispatch and on branch protection changes; its job alone holds security-events: write and id-token: write.

Unverified

• Neither workflow has run on GitHub yet; the first Scorecard run happens on dispatch or the next Monday.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

⚠️ Resolve issues before merging

The Scorecard job is missing actions: read from its explicit permissions. Because job-level permissions replace workflow-level permissions, Scorecard may be unable to inspect workflow metadata and could produce incomplete or failing checks.

The recommended workflow trigger, publishing, upload, and Claude permission scenarios remain unverified by automated tests.

Test suggestions

• Validate Scorecard workflow triggers, action configuration, SARIF generation, and code-scanning upload
• Verify the Claude workflow has empty top-level permissions while its job retains only the required grants
• Verify workflow action references use full commit-SHA pins

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Validate Scorecard workflow triggers, action configuration, SARIF generation, and code-scanning upload
2. Verify the Claude workflow has empty top-level permissions while its job retains only the required grants
3. Verify workflow action references use full commit-SHA pins

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Add actions: read to the Scorecard job permissions so it can inspect workflow metadata.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}