docs: record OpenSSF regression, release, and review evidence

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2026 Xquik Contributors
+# SPDX-License-Identifier: MIT
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/context7-refresh.yml

@@ -20,7 +20,8 @@ permissions: {}
 
 jobs:
   refresh:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
     steps:
       - name: Trigger Context7 refresh
         env:
@@ -35,7 +36,7 @@ jobs:
 
           body_file="$(mktemp)"
           trap 'rm -f "$body_file"' EXIT
-          status="$(curl -sS -o "$body_file" -w "%{http_code}" -X POST "https://context7.com/api/v1/refresh" \
+          status="$(curl --connect-timeout 10 --max-time 30 --proto '=https' -sS --tlsv1.2 -o "$body_file" -w "%{http_code}" -X POST "https://context7.com/api/v1/refresh" \
             -H "Content-Type: application/json" \
             -H "Authorization: Bearer ${CONTEXT7_API_KEY}" \
             -d '{"libraryName": "/xquik-dev/.github"}')"

.github/workflows/public-contract.yml

@@ -11,32 +11,44 @@ on:
     paths:
       - ".github/workflows/public-contract.yml"
       - "ASSURANCE.md"
+      - "BUILD_DEBUG.md"
       - "CODE_OF_CONDUCT.md"
       - "CONTRIBUTING.md"
+      - "DISCOVERY.md"
       - "GOVERNANCE.md"
       - "OPENSSF.md"
+      - "REGRESSION_TESTS.md"
       - "RELEASES.md"
+      - "REVIEW_EVIDENCE.md"
       - "REVIEWING.md"
       - "ROADMAP.md"
       - "SECURITY.md"
       - "profile/README.md"
       - "scripts/check-public-contract.mjs"
+      - "scripts/check-review-evidence.mjs"
+      - "scripts/public-projects.mjs"
   schedule:
     - cron: "17 7 * * 1"
   workflow_dispatch:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 3
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22
+          node-version: 22.23.1
       - run: node scripts/check-public-contract.mjs
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: node scripts/check-review-evidence.mjs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-attestations.yml

@@ -0,0 +1,85 @@
+# Copyright the Xquik contributors.
+# SPDX-License-Identifier: MIT
+
+name: Verify Release Attestations
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/release-attestations.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/release-attestations.yml"
+  schedule:
+    - cron: "43 7 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: release-attestations-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify ${{ matrix.project }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      attestations: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - project: "C# SDK"
+            repository: Xquik-dev/x-twitter-scraper-csharp
+            artifact_template: XTwitterScraper.__VERSION__.nupkg
+            bare_version: "true"
+            signer_workflow: Xquik-dev/x-twitter-scraper-csharp/.github/workflows/publish-nuget.yml
+          - project: Go SDK
+            repository: Xquik-dev/x-twitter-scraper-go
+            artifact_template: x-twitter-scraper-go-__VERSION__.zip
+            bare_version: "false"
+            signer_workflow: Xquik-dev/x-twitter-scraper-go/.github/workflows/release-provenance.yml
+          - project: PHP SDK
+            repository: Xquik-dev/x-twitter-scraper-php
+            artifact_template: x-twitter-scraper-php-__VERSION__.zip
+            bare_version: "false"
+            signer_workflow: Xquik-dev/x-twitter-scraper-php/.github/workflows/release-provenance.yml
+    steps:
+      - name: Download Latest Release Artifact
+        env:
+          ARTIFACT_TEMPLATE: ${{ matrix.artifact_template }}
+          BARE_VERSION: ${{ matrix.bare_version }}
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ matrix.repository }}
+        run: |
+          set -euo pipefail
+          release_tag="$(gh release view --repo "$REPOSITORY" --json tagName --jq .tagName)"
+          artifact_version="$release_tag"
+          if [[ "$BARE_VERSION" == "true" ]]; then
+            artifact_version="${release_tag#v}"
+          fi
+          artifact_name="${ARTIFACT_TEMPLATE/__VERSION__/$artifact_version}"
+          mkdir artifact
+          gh release download "$release_tag" \
+            --repo "$REPOSITORY" \
+            --pattern "$artifact_name" \
+            --dir artifact
+          test -f "artifact/$artifact_name"
+          echo "ARTIFACT=artifact/$artifact_name" >> "$GITHUB_ENV"
+
+      - name: Verify Repository-Bound Provenance
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ matrix.repository }}
+          SIGNER_WORKFLOW: ${{ matrix.signer_workflow }}
+        run: |
+          set -euo pipefail
+          gh attestation verify "$ARTIFACT" \
+            --repo "$REPOSITORY" \
+            --signer-workflow "$SIGNER_WORKFLOW" \
+            --deny-self-hosted-runners

BUILD_DEBUG.md

@@ -0,0 +1,82 @@
+# Debug-Information Preservation Evidence
+
+This register supports the OpenSSF Gold `build_preserve_debug` criterion.
+
+The snapshot date is July 25, 2026.
+
+This register covers all 17 standalone software projects.
+
+OpenSSF asks build systems to preserve requested debug information.
+
+See the official [Gold criterion](https://www.bestpractices.dev/en/criteria?details=true&rationale=true#build_preserve_debug).
+
+Do not count pending changes as default-branch evidence.
+
+## Current Assessment
+
+| Project | Result | Public Evidence | Preserved Debug Context |
+| --- | --- | --- | --- |
+| `hermes-tweet` | Met | [Python package configuration](https://github.com/Xquik-dev/hermes-tweet/blob/master/pyproject.toml) | The wheel preserves Python sources. No stripping step exists. |
+| `n8n-nodes-xquik` | Met | [TypeScript build configuration](https://github.com/Xquik-dev/n8n-nodes-xquik/blob/main/tsconfig.json) | TypeScript emits source maps into the published `dist` directory. |
+| `paperclip-plugin-xquik` | Met | [esbuild configuration](https://github.com/Xquik-dev/paperclip-plugin-xquik/blob/main/esbuild.config.mjs) | esbuild emits source maps with both published bundles. |
+| `prefect-xquik` | Met | [Python package configuration](https://github.com/Xquik-dev/prefect-xquik/blob/main/pyproject.toml) | The wheel preserves Python sources. No stripping step exists. |
+| `terraform-provider-x-twitter-scraper` | Met | [Release configuration](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/blob/main/.goreleaser.yml) and [debug check](https://github.com/Xquik-dev/terraform-provider-x-twitter-scraper/blob/main/bin/check-release-debug-info) | GoReleaser retains DWARF data. Required CI verifies the release binary. |
+| `tweetclaw` | Met | [TypeScript build configuration](https://github.com/Xquik-dev/tweetclaw/blob/master/tsconfig.json) | TypeScript emits source maps into the published `dist` directory. |
+| `x-twitter-scraper` | Met | [Published package configuration](https://github.com/Xquik-dev/x-twitter-scraper/blob/master/package.json) | npm installs source assets directly. No stripping step exists. |
+| `x-twitter-scraper-cli` | Met | [Release configuration](https://github.com/Xquik-dev/x-twitter-scraper-cli/blob/main/.goreleaser.yml) and [debug check](https://github.com/Xquik-dev/x-twitter-scraper-cli/blob/main/bin/check-release-debug-info) | GoReleaser retains DWARF data. Required CI verifies the release binary. |
+| `x-twitter-scraper-csharp` | Met | [.NET build properties](https://github.com/Xquik-dev/x-twitter-scraper-csharp/blob/main/src/Directory.Build.props) | Release packages include symbols with embedded debug information. |
+| `x-twitter-scraper-go` | Met | [Go build check](https://github.com/Xquik-dev/x-twitter-scraper-go/blob/main/scripts/lint) | `go build` honors `GOFLAGS` and does not strip output. |
+| `x-twitter-scraper-java` | Met | [JVM build configuration](https://github.com/Xquik-dev/x-twitter-scraper-java/blob/main/buildSrc/src/main/kotlin/x-twitter-scraper.java.gradle.kts) | Gradle preserves source and line tables in JVM classes. |
+| `x-twitter-scraper-kotlin` | Met | [JVM build configuration](https://github.com/Xquik-dev/x-twitter-scraper-kotlin/blob/main/buildSrc/src/main/kotlin/x-twitter-scraper.java.gradle.kts) | Gradle preserves source and line tables in JVM classes. |
+| `x-twitter-scraper-php` | Met | [Composer package configuration](https://github.com/Xquik-dev/x-twitter-scraper-php/blob/main/composer.json) | Composer installs PHP sources directly. No stripping step exists. |
+| `x-twitter-scraper-python` | Met | [Python package configuration](https://github.com/Xquik-dev/x-twitter-scraper-python/blob/main/pyproject.toml) | The wheel preserves Python sources. No stripping step exists. |
+| `x-twitter-scraper-ruby` | Met | [Ruby package configuration](https://github.com/Xquik-dev/x-twitter-scraper-ruby/blob/main/x_twitter_scraper.gemspec) | The gem preserves Ruby sources. No stripping step exists. |
+| `x-twitter-scraper-typescript` | Met | [TypeScript build configuration](https://github.com/Xquik-dev/x-twitter-scraper-typescript/blob/main/tsconfig.build.json) | TypeScript emits source maps beside published JavaScript. |
+| `xquik-haystack` | Met | [Python package configuration](https://github.com/Xquik-dev/xquik-haystack/blob/main/pyproject.toml) | The wheel preserves Python sources. No stripping step exists. |
+
+## Native Release Verification
+
+The Terraform provider and CLI publish native Go binaries.
+
+Their release configurations previously passed `-s -w` to the Go linker.
+
+Those flags removed symbol and DWARF data.
+
+Each remediation now performs these checks:
+
+1. Build the release binary with GoReleaser.
+2. Select the Linux AMD64 binary from `dist/artifacts.json`.
+3. Inspect its section table with `objdump`.
+4. Require both `.debug_info` and `.debug_line`.
+5. Repeat the check before publishing.
+
+The checks keep `-trimpath` for reproducibility.
+
+## JVM Verification
+
+Java and Kotlin release JARs retain JVM debugging attributes.
+
+Rebuild either project and inspect a main class:
+
+```bash
+./gradlew build
+javap -l -classpath PATH_TO_JAR FULLY_QUALIFIED_CLASS
+```
+
+The output must contain `LineNumberTable`.
+
+The class metadata also retains its source filename.
+
+## Source Package Verification
+
+Python, PHP, and Ruby releases distribute language source files.
+
+Their package builds do not compile or strip native binaries.
+
+The JavaScript and TypeScript projects preserve source context.
+
+They either ship source assets or publish source maps.
+
+Review this register after build or packaging changes.
+
+Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

CONTRIBUTING.md

@@ -8,6 +8,18 @@ Thanks for helping improve public Xquik SDKs, docs, skills, plugins, examples, a
 - Browse issues labeled `help wanted` for broader contributions.
 - Ask for clarification before starting unclear or overlapping work.
 
+## Grow With a Project
+
+Small tasks are a starting point.
+
+Read the selected repository's roadmap before proposing sustained work.
+
+Build useful contributions across focused, reviewed pull requests.
+
+Never split work or inflate metrics to qualify for recognition.
+
+Link merged work in the [OpenSSF human evidence tracker](https://github.com/Xquik-dev/.github/issues/3).
+
 ## Before Opening an Issue or PR
 
 - Use the affected repository when possible.