docs(readme): fix codecov badge; drop vanity badges (#11)

[jessn-dev]

• Develop (Develop #6)

• chore: gitignore agenticscope artifacts; note show-before-fire in M2 roadmap (chore: gitignore agenticscope artifacts; note show-before-fire in M2 …roadmap #2)

Keep all agenticscope dev-tooling artifacts out of the Go repo
(node_modules, .scope/, .mcp.json, generated vendor files). Add the
show-before-fire security hard rule to the M2 roadmap so the
malicious-cheatsheet injection mitigation is designed in, not retrofitted.

• docs: scaffold in-repo docs; wire README; add Discussions/wiki to roadmap (docs: scaffold in-repo docs; wire README; add Discussions/wiki to roa… #3)

Add versioned docs/ (schema, CLI, MCP, install) that track the release.
Fix stale README YAML note (YAML shipped in M1). Roadmap: launch-day
GitHub Discussions and the docs-vs-wiki split under M2 ship.

• chore: gitignore agenticscope artifacts; note show-before-fire in M2 roadmap (chore: gitignore agenticscope artifacts; note show-before-fire in M2 roadmap #4)

Keep all agenticscope dev-tooling artifacts out of the Go repo
(node_modules, .scope/, .mcp.json, generated vendor files). Add the
show-before-fire security hard rule to the M2 roadmap so the
malicious-cheatsheet injection mitigation is designed in, not retrofitted.

• Feat/m2 tui core (Feat/m2 tui core #5)

• feat(engine): include command id in fuzzy search haystack

  Operators can recall a command by its stable id (e.g. nmap-sv), not only its name/intent/tags. Covered by TestSearchFindsByID.

• feat(tui): interactive search/fill/confirm loop with show-before-fire

  Bubble Tea frontend over the engine: fuzzy search, sequential variable prompts, and a confirm screen that displays the fully resolved command before it is printed to stdout. nock never executes — emit is stdout only, gated on explicit confirm (ADR 009/015). Headless flow tests drive the model via key messages.

• ci: add Scorecard + Codecov + standalone govulncheck; regroup README badges

  Split govulncheck into its own workflow for a standalone badge, upload coverage to Codecov, add an OpenSSF Scorecard workflow, and reorganize the README badges (build/quality, activity, community). Privacy-respecting: no third-party visitor or traffic trackers.

• fix(tui): use fmt.Fprintf to satisfy staticcheck QF1012; pin golangci-lint

  CI runs golangci-lint latest (v2.12.2) which flagged WriteString(fmt.Sprintf). Pin the linter version so new rules can't break CI silently.

---

---

• chore(deps): bump the actions group with 3 updates (chore(deps): bump the actions group with 3 updates #7)

Bumps the actions group with 3 updates: codecov/codecov-action, github/codeql-action and ossf/scorecard-action.

Updates codecov/codecov-action from 5 to 7

• Release notes
• Changelog
• Commits

Updates github/codeql-action from 3 to 4

• Release notes
• Changelog
• Commits

Updates ossf/scorecard-action from 2.4.0 to 2.4.3

• Release notes
• Changelog
• Commits

---

updated-dependencies:

• dependency-name: codecov/codecov-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions
• dependency-name: github/codeql-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions
• dependency-name: ossf/scorecard-action dependency-version: 2.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ...

• docs(readme): fix codecov badge, drop vanity badges

  Fix the codecov badge URL (old /branch/main/ path) and wire CODECOV_TOKEN in CI (tokenless uploads are no longer accepted). Remove downloads/stars/forks/watchers badges; replace with Conventional Commits, gitleaks, and CodeRabbit.

---

What

Milestone

Checklist

• make check passes locally (fmt, vet, lint, test)
• Tests added/updated for the change
• No arsenal source code or cheatsheet content bundled (import, never bundle)
• No secrets/API keys committed
• Public API / pkg/format changes are versioned and documented
• Conventional Commit title (feat:, fix:, docs:, …)

Summary by CodeRabbit

• Chores
  • Updated CI and security workflow integrations to use newer action versions and require the configured coverage token for uploads.
  • Refreshed project badges and status indicators in the README, including coverage and review/security badges.
  • Removed the downloads badge and simplified the community/traffic badge section.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 987b01bb-5aa4-4fbf-a854-1b2d22da6096

📥 Commits

Reviewing files that changed from the base of the PR and between 38f1e78 and 5b8b2d4.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .github/workflows/scorecard.yml
• README.md

---

📝 Walkthrough

Walkthrough

GitHub Actions versions are bumped: codecov-action from v5 to v7 with an added CODECOV_TOKEN secret, ossf/scorecard-action to v2.4.3, and github/codeql-action/upload-sarif to v4. README badges are updated to change the Codecov URL, add CodeRabbit and gitleaks badges, and remove the Downloads and social traffic badges.

Changes

CI and README maintenance

Layer / File(s)	Summary
Action version bumps and badge updates .github/workflows/ci.yml, .github/workflows/scorecard.yml, README.md	Codecov action upgraded to v7 with token-based upload; scorecard and SARIF upload actions bumped to newer versions; README Codecov badge URL updated, CodeRabbit and gitleaks badges added, Downloads and social badges removed.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!