[EquityBot]

Summary

Adds scorecard.yml, copied from Alcuin, so the OpenSSF Scorecard API publishes a result for this repository (it currently returns 404).

Evidence

• actionlint: clean on every workflow.
• zizmor 1.31.1: scorecard.yml no findings.

Merge danger

Door: two-way. Blast radius: CI

Scorecard runs weekly, on dispatch and on branch protection changes; its job alone holds security-events: write and id-token: write.

Unverified

• The workflow has not run on GitHub yet; the first run happens on dispatch or the next Monday.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

✅ No blocking issues noticed

No blocking findings were identified. Workflow execution and event-trigger behavior remain unverified and should be covered by integration checks.

Test suggestions

• Validate that the workflow configuration is syntactically valid and accepted by GitHub Actions.
• Verify a workflow run produces Scorecard SARIF output and successfully uploads it to code scanning.
• Verify scheduled, manual, and branch-protection-rule events start the analysis job.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Validate that the workflow configuration is syntactically valid and accepted by GitHub Actions.
2. Verify a workflow run produces Scorecard SARIF output and successfully uploads it to code scanning.
3. Verify scheduled, manual, and branch-protection-rule events start the analysis job.

Low confidence findings

• Please validate the workflow in GitHub to confirm result publication, SARIF upload, and all configured event triggers behave as expected.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}