chore: org hardening — SHA-pinned actions, governance docs, Scorecard, issue forms - #501

Merged

FumingPower3925 merged 7 commits into

mainfrom

chore/org-hardening

Sep 5, 2026

Commits on Sep 5, 2026

ci: pin actions and tools to exact versions, drop checkout credentials, add zizmor
FumingPower3925
committed
8288914
ci(release): SHA-pin actions, least-privilege token, env-scoped tag name
FumingPower3925
committed
ccf28de
ci: add OpenSSF Scorecard workflow
FumingPower3925
committed
881095a
docs: add GOVERNANCE.md, MAINTAINERS.md and CODEOWNERS
FumingPower3925
committed
8843255
docs(contributing): document merge rule, labels/release notes and DCO sign-off
FumingPower3925
committed
4bee6af
docs(security): prefer private vulnerability reporting, 72 h acknowledgement
FumingPower3925
committed
2b42f9f
chore(github): issue forms, PR template checklist and release-notes config
FumingPower3925
committed
51a5e12