[dDevAhmed]

Summary

Implements CLI-014 with OpenSSF Scorecard analysis for the public StellarForge CLI repository.

Included

• official OpenSSF Scorecard Action v2.4.4 pinned to commit 2d1146689b8cda280b9bc96326124645441f03bc
• analysis on pushes to main
• weekly scheduled analysis
• public Scorecard result publication via GitHub OIDC
• SARIF upload to GitHub code scanning
• 5-day SARIF workflow artifact for review/debugging
• security guidelines documenting how maintainers should interpret and triage Scorecard findings

Result-handling actions

• actions/checkout v7.0.1 pinned to 3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/upload-artifact v7.0.1 pinned to 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• github/codeql-action/upload-sarif v4.37.7 pinned to ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd

Security / permissions

• global workflow permissions remain read-only
• the Scorecard job receives only contents: read, security-events: write, and id-token: write
• checkout credentials are not persisted
• no repository secrets are used
• no pull_request_target
• the Scorecard workflow does not run on pull requests, so OIDC/result-publication privileges are never granted while executing untrusted PR code
• only the official Scorecard-approved action set is used in the privileged job

Schedule

The weekly scan runs Saturday at 05:43 UTC. The non-round minute avoids common top-of-hour scheduling congestion.

Acceptance strategy

The PR itself is reviewed by the existing Quality and CodeQL gates. After merge, the push to main must successfully execute Scorecard, publish/upload results, and produce the short-lived SARIF artifact before CLI-014 is treated as fully accepted.

Closes #17