chore: add OpenSSF readiness baseline

[seonghobae]

Summary

• add missing OpenSSF Scorecard workflow/security/dependency metadata where needed
• enable repository-level OSSF Best Practices prerequisites without changing product code
• keep existing source code and CI implementation unchanged

Notes

This PR is part of the ContextualWisdomLab non-fork repository OpenSSF readiness sweep. Public repositories will be registered on bestpractices.dev after the baseline metadata is available on the default branch.

[opencode-agent]

Pull request overview

OpenCode model attempts did not emit a usable current-head control block, so the approval gate used deterministic current-head evidence instead of model prose.

Findings

No blocking findings.

Summary

• Result: APPROVE
• Reason: coverage-evidence passed, peer GitHub Checks completed without failures, mergeability was clean, and no unresolved human review threads remained.
• Deterministic evidence: current-head changed-file evidence (.github/dependabot.yml, .github/workflows/scorecard-analysis.yml, LICENSE); coverage-evidence result success; peer checks from statusCheckRollup excluding this OpenCode check.
• Model outcomes: primary=failed, fallback=failed, second_fallback=failed, catalog_fallback=failed.
• Head SHA: 1472ec7c12b4c8accdbaafd3eedf2c7d4d5ef605
• Workflow run: 28432525042
• Workflow attempt: 1

Deterministic fallback approval was used only after model-output instability and did not bypass coverage, failed-check, mergeability, or human-review gates.

Change Flow DAG

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Workflow: scorecard-analysis.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: scorecard-analysis.yml"]
R2 --> V2["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 1472ec7c12b4c8accdbaafd3eedf2c7d4d5ef605
• Workflow run: 28432525042
• Workflow attempt: 1
• Gate result: APPROVE (approval step)

Pull request overview

OpenCode model attempts did not emit a usable current-head control block, so the approval gate used deterministic current-head evidence instead of model prose.

Findings

No blocking findings.

Summary

• Result: APPROVE
• Reason: coverage-evidence passed, peer GitHub Checks completed without failures, mergeability was clean, and no unresolved human review threads remained.
• Deterministic evidence: current-head changed-file evidence (.github/dependabot.yml, .github/workflows/scorecard-analysis.yml, LICENSE); coverage-evidence result success; peer checks from statusCheckRollup excluding this OpenCode check.
• Model outcomes: primary=failed, fallback=failed, second_fallback=failed, catalog_fallback=failed.
• Head SHA: 1472ec7c12b4c8accdbaafd3eedf2c7d4d5ef605
• Workflow run: 28432525042
• Workflow attempt: 1

Deterministic fallback approval was used only after model-output instability and did not bypass coverage, failed-check, mergeability, or human-review gates.

Change Flow DAG

flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (2 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (2 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Workflow: scorecard-analysis.yml"]
S2 --> I2["GitHub Actions review job"]
I2 --> R2["Review risk: Workflow: scorecard-analysis.yml"]
R2 --> V2["actionlint plus required checks"]

Loading