🏗️✨：grade the defaults security practices

[DerekNonGeneric]

Requested by DerekNonGeneric

Before: the SDK's Security tab carries an OpenSSF Scorecard grade and this
repository's does not, although most of what that grade measures — the branch
protection, the pinned actions, the token permissions — is decided here and
inherited from here. Whoever arrives from a published package and follows the
metadata back finds the community health files without the grade the code
carries.

After: this repository is graded by the same workflow on the same schedule, and
the result appears in its own Security tab.

It adds .github/workflows/scorecard.yml, ported from the SDK, along with the
three words the spell checker needs to read it.

How: the workflow runs on a push to main, on a branch protection rule change,
and weekly on Monday in a slot clear of the CodeQL, Semgrep and link-rot runs.
It needs no secret and no app. The analysis is skipped while the repository is
private, because the checks read history through an API the default token cannot
reach on a private one and publishing a result is public by definition. The
SARIF upload is pinned to the same github/codeql-action commit that
codeql-analysis.yml already uses, so renovate moves the two together.

This is the workflow only. The checks that need a decision rather than a file —
branch protection above all — are still open on the issue.

Refs: #178

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: bb50501b-be8a-4f67-b973-e518a73ecbcf

📥 Commits

Reviewing files that changed from the base of the PR and between 4cd686f and 051ac9b.

📒 Files selected for processing (2)

• .github/workflows/scorecard.yml
• project-terms.txt

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The pull request adds a GitHub Actions workflow that runs OpenSSF Scorecard on selected repository events and a weekly schedule. It restricts permissions, pins actions to commit SHAs, and uploads SARIF results. It also updates project terms.

Changes

Scorecard analysis

Layer / File(s)	Summary
Scorecard workflow and terminology .github/workflows/scorecard.yml, project-terms.txt	The workflow runs on branch-protection changes, pushes to main, and a weekly Monday schedule. It skips private repositories, uses restricted permissions, pins actions to commit SHAs, runs Scorecard with SARIF output, and uploads the report to the Security tab. The project terms list adds ossf, SARIF, and sarif.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Repository
  participant OpenSSFScorecard
  participant SecurityTab
  GitHubActions->>Repository: Check out repository without persisted credentials
  Repository->>OpenSSFScorecard: Provide repository contents
  OpenSSFScorecard->>GitHubActions: Generate and publish SARIF results
  GitHubActions->>SecurityTab: Upload SARIF report

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly identifies the main change: grading the repository's security practices. It is concise, but the wording is grammatically awkward and includes unnecessary emojis.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}