Security Gates, Dependabot and Scorecard #56

Parent

Spec: #33 (Baseline release). Section numbers refer to its Implementation Decisions.

What to build

A pull request cannot merge with a known-vulnerable dependency, a new high-severity CodeQL alert or a copyleft license, dependency updates arrive on the agreed rules, and wand publishes an OpenSSF Scorecard a stranger can check. Spec section 16; ticket #31.

Acceptance criteria

• govulncheck ./... runs in the linux/amd64 Go stable job as a Gate.
• CodeQL default setup for Go is enabled; the pull-request check is required and fails only on new high or error alerts; pre-existing alerts are fixed or dismissed with a reason so the count is zero.
• Dependency review runs on every pull request and fails on high-or-worse advisories and on any license outside MIT, BSD-2-Clause, BSD-3-Clause, Apache-2.0, ISC and MPL-2.0.
• Dependabot: github-actions weekly, docker weekly (digest moves), npm weekly grouped for the lint lockfile, gomod security updates only with no version pull requests.
• OpenSSF Scorecard runs weekly and on push to main, publishes to the OpenSSF API and to code scanning; the badge markdown is recorded for the README ticket.
• gosec stays disabled in the golangci-lint configuration, as upstream had it.

Blocked by

• Minimal Gate on linux/amd64 with 100 % coverage and the main ruleset #36 (Minimal Gate on linux/amd64 with 100 % coverage and the main ruleset)
• Protocol regenerated from devtools-protocol and the generate Gate #42 (Protocol regenerated from devtools-protocol and the generate Gate)