@sebastienrousseau/dotfiles 0.2.520 → 0.2.522

package/docs/security/KEYS.md

@@ -1,49 +0,0 @@
----
-render_with_liquid: false
----
-
-# Keybindings
-
-This is the single source of truth for navigation and muscle-memory shortcuts
-across the dotfiles stack. Keep it concise and consistent.
-
-## Zsh
-
-- `Ctrl+R`: History search (`fzf`/`atuin` if enabled)
-- `Ctrl+P` / `Ctrl+N`: History prefix search (up/down)
-
-## Tmux (prefix = `Ctrl-a`)
-
-- `Prefix + r`: Reload config
-- `Prefix + N`: New window
-- `Prefix + a` / `Tab`: Last window
-- `Prefix + %`: Split vertical (current path)
-- `Prefix + "`: Split horizontal (current path)
-- `Prefix + \`: Split vertical (alt)
-- `Prefix + |`: Split horizontal (alt)
-- `Prefix + h/j/k/l`: Move between panes (vim-style)
-- `Prefix + z`: Toggle zoom pane
-- `Prefix + H/J/K/L`: Resize pane (left/down/up/right)
-
-## Neovim (leader = `Space`)
-
-- `Ctrl-h/j/k/l`: Move between splits
-- `Ctrl-s`: Save file
-- `Leader + ff`: Find files (Telescope)
-- `Leader + fg`: Live grep (Telescope)
-- `Leader + q`: Quit
-
-## Shell Tools
-
-- `z <dir>`: Jump to a directory (`zoxide`)
-- `lg`: Open `lazygit`
-
-## Terminal
-
-- `Ctrl+Shift+C`: Copy
-- `Ctrl+Shift+V`: Paste
-
----
-
-Update this file when bindings change. If you add a new tool, add its shortcuts
-here and keep them aligned with the global conventions.

package/docs/security/KEY_ROTATION.md

@@ -1,303 +0,0 @@
----
-render_with_liquid: false
----
-
-# Key Rotation Guide
-
-This page tracks two distinct key lifecycles:
-
-1. **Disclosure key** — the GPG key reporters use to encrypt vulnerability reports to the maintainer. Single key, public, rotated annually or on compromise. Source of truth for the active fingerprint is `SECURITY.md`.
-2. **Secrets encryption keys** — the Age and SOPS keys that protect encrypted dotfiles in this repo. Multiple keys, per-machine, rotated annually or on personnel / device change.
-
-Both sections live here so a single audit can confirm the project's
-posture across encrypted-disclosure-in and encrypted-secrets-at-rest.
-
-## Disclosure Key (GPG)
-
-Closes the rotation half of [#870](https://github.com/sebastienrousseau/dotfiles/issues/870).
-
-### Active key
-
-| Field | Value |
-|---|---|
-| Identity | `security@sebastienrousseau.com` |
-| Fingerprint | `55AFAD364FD9DB3819E61F0C8D688FAFA9144693` |
-| Algorithm | ED25519 signing primary + CV25519 encryption subkey |
-| Created | 2026-05-16 |
-| Expires | 2029-05-15 (3 years from creation) |
-| WKD URL | <https://sebastienrousseau.com/.well-known/openpgpkey/hu/qpzqfwauiwxnu1xrf5h47bunsho44p6f> |
-| Cross-reference | matches the SSH signing key in `dot_config/git/allowed_signers.tmpl` |
-
-### Rotation triggers
-
-| Trigger | Response time | Action |
-|---|---|---|
-| Annual cadence | Within 30 days of expiry | Generate new key, publish, sign transition statement with the old key, archive old key below. |
-| Suspected compromise | Same day | Revoke immediately, publish revocation cert to WKD, replay in-flight encrypted disclosures with the new key. |
-| Algorithm deprecation | Within 90 days of advisory | Generate replacement on a stronger algorithm; follow annual-cadence steps. |
-| Maintainer change | Same day as handover | Old maintainer signs a transition statement; old key revoked 30 days after handover. |
-
-### Rotation procedure
-
-1. Generate the new key (air-gapped where possible):
-
-   ```sh
-   gpg --quick-generate-key \
-     "Sebastien Rousseau (Security) <security@sebastienrousseau.com>" \
-     ed25519 sign 1y
-   ```
-
-2. Sign a transition statement with the OLD key:
-
-   ```sh
-   gpg --clearsign <<EOF
-   Transition statement, $(date -u +%Y-%m-%dT%H:%M:%SZ).
-   The disclosure key for security@sebastienrousseau.com rotates from:
-     OLD: <old-fingerprint>
-     NEW: <new-fingerprint>
-   Encrypted reports sent to either key during the 30-day overlap
-   will be accepted. After <UTC-cutoff>, only the new key is honoured.
-   EOF
-   ```
-
-3. Publish the new key to:
-   - `sebastienrousseau.com/.well-known/openpgpkey/hu/` (WKD)
-   - the maintainer's keyoxide profile if applicable
-
-4. Update the "Active key" table above with the new fingerprint and
-   move the previous row into the "Historical disclosure keys"
-   table below with the actual revocation date.
-
-5. Commit, signing with both old and new keys during the overlap:
-
-   ```sh
-   git commit -S -m "security(key): rotate disclosure key $(date +%Y-%m)" \
-     -m "$(cat transition.asc)"
-   ```
-
-6. After the 30-day overlap, revoke the old key and publish the
-   revocation cert to the same WKD endpoint.
-
-### Historical disclosure keys
-
-| From | Until | Fingerprint | Reason for rotation |
-|---|---|---|---|
-| *(none yet — first key)* | *—* | *—* | *—* |
-
----
-
-## Age Key Rotation
-
-### When to Rotate
-
-- **Annually**: As a preventive measure
-- **After compromise**: If you suspect key exposure
-- **Personnel change**: When team members leave
-- **Device loss**: If a device with the key is lost/stolen
-
-### Rotation Procedure
-
-#### 1. Generate New Key
-
-```bash
-# Create new age key
-age-keygen -o ~/.config/chezmoi/key-new.txt
-
-# Note the public key (starts with "age1...")
-cat ~/.config/chezmoi/key-new.txt | grep "public key"
-```
-
-#### 2. Re-encrypt All Secrets
-
-```bash
-# List all encrypted files
-chezmoi managed --include=encrypted
-
-# For each encrypted file, decrypt with old key and re-encrypt with new
-for file in $(chezmoi managed --include=encrypted); do
-  # Decrypt with old key
-  chezmoi cat "$file" > "/tmp/$(basename $file).dec"
-
-  # Re-encrypt with new key (update chezmoi config first)
-  # See step 3
-done
-```
-
-#### 3. Update Chezmoi Configuration
-
-Edit `~/.config/chezmoi/chezmoi.toml`:
-
-```toml
-[age]
-  identity = "~/.config/chezmoi/key-new.txt"
-  recipient = "age1your_new_public_key_here"
-```
-
-#### 4. Re-add Encrypted Files
-
-```bash
-# Re-add each secret with new encryption
-chezmoi add --encrypt ~/.ssh/id_ed25519
-chezmoi add --encrypt ~/.config/secrets/api-keys.env
-```
-
-#### 5. Verify and Clean Up
-
-```bash
-# Verify decryption works
-chezmoi cat ~/.ssh/id_ed25519
-
-# Archive old key (store securely offline)
-mv ~/.config/chezmoi/key.txt ~/.config/chezmoi/key-$(date +%Y%m%d)-archived.txt
-
-# Rename new key
-mv ~/.config/chezmoi/key-new.txt ~/.config/chezmoi/key.txt
-
-# Commit changes
-cd ~/.dotfiles
-git add -A
-git commit -m "chore(secrets): rotate age encryption key"
-```
-
-### Emergency Rotation (Compromised Key)
-
-```bash
-# 1. Immediately generate new key
-age-keygen -o ~/.config/chezmoi/key-emergency.txt
-
-# 2. Re-encrypt ALL secrets (prioritize most sensitive)
-# 3. Revoke/rotate any API keys, tokens that were encrypted
-# 4. Update any shared secrets with team members
-# 5. Document the incident
-```
-
----
-
-## SOPS Key Rotation
-
-### Overview
-
-SOPS supports multiple key types. This covers Age keys (recommended) and GPG keys.
-
-### SOPS with Age Keys
-
-#### Generate New Key
-
-```bash
-age-keygen -o ~/.config/sops/age/keys-new.txt
-```
-
-#### Update .sops.yaml
-
-```yaml
-creation_rules:
-  - path_regex: \.env$
-    age: >-
-      age1new_key_here,
-      age1old_key_here  # Keep old key temporarily for decryption
-```
-
-#### Re-encrypt Files
-
-```bash
-# Rotate key for a single file
-sops updatekeys secrets.env
-
-# Or re-encrypt entirely
-sops -d secrets.env | sops -e /dev/stdin > secrets.env.new
-mv secrets.env.new secrets.env
-```
-
-#### Remove Old Key
-
-After confirming all files are re-encrypted:
-
-1. Remove old key from `.sops.yaml`
-2. Archive old key securely
-3. Commit changes
-
-### SOPS with GPG Keys
-
-```bash
-# Generate new GPG key
-gpg --full-generate-key
-
-# Export fingerprint
-gpg --list-keys --keyid-format LONG
-
-# Update .sops.yaml with new fingerprint
-# Re-encrypt files
-sops updatekeys <file>
-```
-
----
-
-## Automation Scripts
-
-### Check Key Age
-
-```bash
-#!/usr/bin/env bash
-# check-key-age.sh - Alert if keys are older than 365 days
-
-KEY_FILE="${HOME}/.config/chezmoi/key.txt"
-MAX_AGE_DAYS=365
-
-if [[ -f "$KEY_FILE" ]]; then
-  key_age=$(( ($(date +%s) - $(stat -c %Y "$KEY_FILE")) / 86400 ))
-
-  if [[ $key_age -gt $MAX_AGE_DAYS ]]; then
-    echo "⚠️  Age key is ${key_age} days old. Consider rotation."
-    exit 1
-  else
-    echo "✓ Age key is ${key_age} days old (limit: ${MAX_AGE_DAYS})"
-  fi
-fi
-```
-
-### Automated Backup Before Rotation
-
-```bash
-#!/usr/bin/env bash
-# backup-before-rotation.sh
-
-BACKUP_DIR="${HOME}/.local/share/dotfiles/key-backups"
-mkdir -p "$BACKUP_DIR"
-
-# Backup current key
-cp ~/.config/chezmoi/key.txt "$BACKUP_DIR/key-$(date +%Y%m%d_%H%M%S).txt"
-
-# Encrypt backup with passphrase
-gpg --symmetric --cipher-algo AES256 "$BACKUP_DIR/key-$(date +%Y%m%d_%H%M%S).txt"
-
-# Remove unencrypted backup
-rm "$BACKUP_DIR/key-$(date +%Y%m%d_%H%M%S).txt"
-
-echo "Key backed up to $BACKUP_DIR (encrypted)"
-```
-
----
-
-## Best Practices
-
-1. **Never commit unencrypted keys** - Use `.gitignore` properly
-2. **Store backups offline** - USB drive in secure location
-3. **Use hardware keys when possible** - YubiKey with age-plugin-yubikey
-4. **Document rotation dates** - Keep a log of when keys were rotated
-5. **Test decryption** - Always verify after rotation
-6. **Notify team members** - If using shared secrets
-
-## Recovery Procedures
-
-If you lose access to your key:
-
-1. **Check backups** - Offline storage, password manager
-2. **Check other machines** - Key may exist on another device
-3. **Re-create secrets** - As last resort, regenerate API keys, tokens, etc.
-
-## Related Documentation
-
-- [SECRETS.md](SECRETS.md) - Secrets management overview
-- [SECURITY.md](SECURITY.md) - Security hardening guide
-- [Age documentation](https://github.com/FiloSottile/age)
-- [SOPS documentation](https://github.com/getsops/sops)

package/docs/security/MCP_POLICY.md

@@ -1,78 +0,0 @@
----
-render_with_liquid: false
----
-
-# MCP Policy
-
-MCP is treated as a controlled execution boundary.
-
-## Default posture
-
-The tracked default is `strict-local`.
-
-Properties:
-
-- local-first
-- least privilege
-- no broad filesystem roots
-- no wildcard or unsafe flags
-- no network-facing MCP servers enabled by default
-- machine-readable validation output
-
-## Policy artifact
-
-The source of truth lives in [mcp-policy.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-policy.json).
-Approved package pins live in [mcp-lock.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-lock.json).
-Tracked server registry entries live in [mcp-registry.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-registry.json).
-
-Current defaults:
-
-- Allowed launchers: `npx`, `node`, `uvx`
-- Trusted transports: `stdio`, `http`
-- Blocked filesystem roots: `/`, `/home`, `/Users`
-- Blocked argument patterns: `^--allow-.*`, `^--unsafe$`, `^\\*$`
-- Network-facing servers disabled by default: `github`, `brave-search`, `fetch`, `puppeteer`, `filesystem`
-- Approved packages must resolve through the tracked MCP lock manifest
-- Every active server must match the tracked MCP registry
-- HTTP transports must use `https://` and registry-declared OAuth2
-
-## Validation
-
-Run:
-
-```bash
-dot mcp --strict
-dot mcp -s -j
-dot mcp registry
-```
-
-The JSON form is the audit artifact for CI, release validation, and workstation attestation.
-
-## Change control
-
-Any change to MCP policy requires:
-
-1. A signed commit
-2. A matching test update
-3. A release note if the effective trust boundary changes
-4. A policy bundle review when enterprise defaults change
-
-## Supply-chain controls
-
-Phase 2 adds explicit package locking for default MCP servers.
-
-Current approved refs:
-
-- `mcp-server-git@2025.1.14`
-- `@modelcontextprotocol/server-memory@2025.8.4`
-- `mcp-server-sqlite@2025.1.14`
-
-`dot mcp --strict` and `dot mcp -s` now verify that:
-
-- package refs are version-pinned
-- the pinned refs match the tracked lock manifest
-- non-approved package refs are rejected in strict mode
-- active servers match the tracked registry entries
-- remote HTTP transports are HTTPS and OAuth-backed
-
-Policy bundle baselines live in [policy-bundles.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/policy-bundles.json).

package/docs/security/POLICY_RELEASES.md

@@ -1,37 +0,0 @@
----
-render_with_liquid: false
----
-
-# Policy Bundle Releases
-
-Policy bundles are released as tracked governance artifacts.
-
-They include:
-
-- policy bundles
-- model registry
-- prompt registry
-- agent profiles
-- agent card
-- MCP policy, registry, and lock
-- A2A discovery metadata
-
-## Local packaging
-
-```bash
-bash tools/release/package-policy-bundles.sh --version 2026.03
-bash tools/release/package-policy-bundles.sh --json
-```
-
-## Release workflow
-
-Use the `Policy Bundle Release` workflow.
-
-Release controls:
-
-- source ref must be signed
-- governance JSON must validate with `jq`
-- bundle archive gets a SHA-256 checksum
-- bundle archive gets GitHub provenance attestation
-
-Signed commits remain mandatory for any policy change.

package/docs/security/README.md

@@ -1,28 +0,0 @@
----
-render_with_liquid: false
----
-
-# Security Documentation
-
-This directory contains security documentation for the dotfiles project.
-
-## Index
-
-| Document | Description |
-|----------|-------------|
-| [SECURITY.md](SECURITY.md) | Core security model and opt-in hardening |
-| [THREAT_MODEL.md](THREAT_MODEL.md) | Threat analysis with trust boundaries |
-| [SECRETS.md](SECRETS.md) | Secrets management (Age, SOPS, Keychain) |
-| [KEY_ROTATION.md](KEY_ROTATION.md) | Key rotation procedures |
-| [KEYS.md](KEYS.md) | Keybindings reference |
-| [COMPLIANCE.md](COMPLIANCE.md) | SOC 2, ISO 27001, GDPR, HIPAA mapping |
-| [AI_ACT_COMPLIANCE.md](AI_ACT_COMPLIANCE.md) | EU AI Act risk classification and exemption analysis |
-| [SECURITY_CHECKLIST.md](SECURITY_CHECKLIST.md) | Pre-release security verification |
-
-## Quick Reference
-
-- **Encryption:** Age + SOPS for secrets at rest
-- **Signing:** SSH ED25519 commit signing enforced
-- **Scanning:** Gitleaks pre-commit hook prevents credential leaks
-- **Telemetry:** Disabled by default, no data leaves your machine
-- **Hardening:** Opt-in firewall, DNS-over-HTTPS, lock-screen, USB safety

package/docs/security/SCORECARD.md

@@ -1,195 +0,0 @@
----
-render_with_liquid: false
----
-
-# OpenSSF Scorecard
-
-This page records the current OpenSSF Scorecard posture for this
-repository, the known gaps, and the remediation roadmap. The badge in
-the README links to the live result; this page is the maintained
-narrative behind it.
-
-## Live score
-
-<!-- BEGIN scorecard-snapshot (auto-generated, do not edit by hand) -->
-Aggregate score **7.6 / 10** at 2026-05-17T08:11:51Z.
-
-| Check | Score | Reason |
-|---|---:|---|
-| Binary-Artifacts | 10 | no binaries found in the repo |
-| Branch-Protection | -1 | internal error: error during branchesHandler.setup: internal error: some github tokens can't read cl |
-| CI-Tests | 10 | 15 out of 15 merged PRs checked by a CI test -- score normalized to 10 |
-| CII-Best-Practices | 2 | badge detected: InProgress |
-| Code-Review | 0 | Found 0/30 approved changesets -- score normalized to 0 |
-| Contributors | 0 | project has 0 contributing companies or organizations -- score normalized to 0 |
-| Dangerous-Workflow | 10 | no dangerous workflow patterns detected |
-| Dependency-Update-Tool | 10 | update tool detected |
-| Fuzzing | 0 | project is not fuzzed |
-| License | 9 | license file detected |
-| Maintained | 10 | 30 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10 |
-| Packaging | 10 | packaging workflow detected |
-| Pinned-Dependencies | 9 | dependency not pinned by hash detected -- score normalized to 9 |
-| SAST | 10 | SAST tool is run on all commits |
-| Security-Policy | 10 | security policy file detected |
-| Signed-Releases | 3 | 1 out of the last 3 releases have a total of 2 signed artifacts. |
-| Token-Permissions | 10 | GitHub workflow tokens follow principle of least privilege |
-| Vulnerabilities | 10 | 0 existing vulnerabilities detected |
-
-*Refresh: `scripts/qa/scorecard-snapshot.sh` · Monitoring: `.github/workflows/scorecard.yml`.*
-<!-- END scorecard-snapshot -->
-
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sebastienrousseau/dotfiles/badge)](https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles)
-
-The badge above is regenerated every Monday at 06:00 UTC and on every
-push to `main` by `.github/workflows/scorecard.yml`. The SARIF
-result is uploaded to GitHub Code Scanning (Security tab) and
-retained as a 30-day workflow artifact.
-
-## Threshold policy
-
-| Score | Action |
-|---|---|
-| ≥ 8.0 | Healthy. Keep doing what we're doing. |
-| 7.0 – 7.9 | Acceptable. Tracked. |
-| < 7.0 | Regression — the workflow auto-opens a tracking issue labelled `type:security + priority:high`. |
-
-Regressions are triaged within one Monday cycle: identify the check
-that dropped, either remediate or file an exception entry below with
-a rationale and an expiry date.
-
-## Per-check posture (snapshot, main HEAD)
-
-The checks below come from OpenSSF Scorecard's published rubric. Tick
-marks reflect this repo's posture at the time of writing — the
-*live* badge is authoritative if these diverge.
-
-| Check | Status | Notes |
-|---|---|---|
-| Branch-Protection | ⚠ | `main` requires signed commits, linear history, required checks (`.github/rulesets/main.json`). Scorecard can't read classic protection rules without a fine-grained PAT, so this check reports as `-1` ("internal error"). |
-| Code-Review | ⚠ | Single-maintainer repo; PRs are self-merged after CI. Scorecard scores 0/30 here by design — see `Open findings` below. |
-| Signed-Commits | ✓ | Enforced by pre-push hook (`scripts/git-hooks/pre-push`) and at-push by branch protection (#853 + #857). |
-| Dependency-Update-Tool | ✓ | Dependabot configured for github-actions / npm / docker / devcontainers / uv. |
-| Fuzzing | ⚠ | `install.sh` fuzz harness lives under `fuzz/install/` (closes #881), but it's shell-based and Scorecard's heuristic only recognizes OSS-Fuzz / ClusterFuzzLite / native Go fuzz / libFuzzer / Atheris. None support shell. Property tests under `tests/unit/functions/test_property_*.sh` cover the closest equivalent surface. |
-| License | ✓ | MIT at repo root (`LICENSE`). |
-| Maintained | ✓ | Active commit cadence; the [README](https://github.com/sebastienrousseau/dotfiles/blob/main/README.md) lists the current `dotfiles_version`. |
-| Pinned-Dependencies | ⚠ | Closed 8 of 14 findings this cycle (every Dockerfile base + every workflow action + 2 `curl \| sh` installers + the `npm install -g npm` upgrade step). 5 residual findings stay open by design — see `Open findings`. |
-| SAST | ✓ | CodeQL (`.github/workflows/codeql.yml`) + Checkov + Grype. |
-| SBOM | ✓ | Generated per PR by `sbom-diff.yml` and per release by `security-release.yml`. |
-| Security-Policy | ✓ | `SECURITY.md` + this page + `docs/security/THREAT_MODEL.md`. |
-| Token-Permissions | ✓ | Top-level `permissions:` blocks restricted to `contents: read`. `write` scopes scoped to the jobs that need them (#886). |
-| Vulnerabilities | ✓ | Grype gate hard-fails on `high` / `critical` on `main` (#852). |
-| Webhooks | n/a | No external webhooks configured. |
-| CI-Tests | ✓ | Linux + macOS Intel + Apple Silicon matrix; optional Windows. |
-| CII-Best-Practices | ☐ | Not applied yet — see `Open work` below. |
-| Dangerous-Workflow | ✓ | No `pull_request_target` with checkout-PR-code anti-pattern. |
-| Packaging | ✓ | `npm publish --provenance` via OIDC (`.github/workflows/npm-publish.yml`); `policy-bundle-release.yml` for the policy artifact. |
-| Signed-Releases | ⚠ | SLSA provenance + minisig attached via `security-release.yml`; Cosign keyless signing tracked at #876. |
-
-## Open findings
-
-The eight items below are surfaced as alerts at
-<https://github.com/sebastienrousseau/dotfiles/security/code-scanning>.
-Each row gives the dismissal **reason** and the exact **comment text**
-to paste when triaging.
-
-### Bucket 1 — Dismiss in the UI (5 items)
-
-Scorecard flags every `npm install`, `pip install`, `go install`, and
-`curl | sh` invocation under the `Pinned-Dependencies` check. The five
-below either belong to user-facing "update everything" aliases or are
-false positives in Scorecard's regex.
-
-| Path | Reason | Comment to paste |
-|---|---|---|
-| `.chezmoitemplates/aliases/legal/legal.aliases.sh:64` | **Won't fix** | User-facing convenience alias — `go install <fortune-style joke command>@latest`. Pinning by SHA would require users to update the alias manually on every upstream change. Intentional. |
-| `.chezmoitemplates/aliases/update/update.aliases.sh:173` | **Won't fix** | User-facing convenience alias — bulk-update wrapper around `npm`. The alias's purpose is to update everything; pinning defeats it. Intentional. |
-| `dot_local/bin/executable_update:99` | **Won't fix** | `dot_local/bin/executable_update` is the user-invoked "update everything" command. The literal point of `npm update -g` is to update to whatever's latest. Pinning defeats it. Intentional. |
-| `scripts/dot/commands/tools.sh:121` | **False positive** | `npm install --package-lock-only --ignore-scripts --silent` generates a lockfile and does NOT fetch packages. Scorecard's regex matches `npm install` blindly; this invocation has no supply-chain surface. |
-| `install/provision/run_onchange_10-linux-packages.sh.tmpl:369` | **Won't fix** | Already exact-version-pins `aider-chat==0.86.2`. Scorecard wants sha256-hash pinning, which would require a ~2,700-line lockfile covering all 108 transitive deps and re-generated on every aider release — disproportionate maintenance for a single optional provisioning install. |
-
-### Bucket 2 — Architectural (1 item)
-
-| Alert | Why architectural |
-|---|---|
-| `CodeReviewID` (high) — score 0 | Scorecard requires every merged PR to record an approval review by a different GitHub user than the author. This repo is single-maintainer; PRs are self-merged after CI. The fix path is either (a) onboard a co-maintainer who reviews PRs before merge, or (b) accept the finding. Dismiss as **Won't fix** with comment: "Single-maintainer project — no second reviewer available. CI gates (47 required checks per PR) substitute for human review." |
-
-### Bucket 3 — External action (2 items)
-
-| Alert | Action |
-|---|---|
-| `FuzzingID` (medium) | Dismiss as **Won't fix** with comment: "Repo is bash + Go-template + Lua. ClusterFuzzLite / OSS-Fuzz / native Go fuzz / libFuzzer / Atheris (the frameworks Scorecard recognises) all target compiled languages, none support shell. The `fuzz/install/fuzz_install.sh` harness + property tests under `tests/unit/functions/test_property_*.sh` cover the equivalent surface." |
-| `CIIBestPracticesID` (low) | Apply at <https://www.bestpractices.dev/projects/new>. ~67 self-attested questions, free, 1-2 hours. After silver-tier approval, paste the badge into `README.md` next to the existing Scorecard badge. Most criteria already met (signed commits, CI, security policy, license). |
-
-## Closed this cycle
-
-| Date | Score | Alerts open | Change |
-|---|---|---|---|
-| 2026-05-14 | 6.5 | 28 | First clean publish after fixing the scorecard.yml `uses:`-only restriction (#885). Findings had been hidden by publish-step 400s until then. |
-| 2026-05-14 | 6.5 | 11 | Closed 17 of 28: 10× TokenPermissions (#886), 6× Dockerfile bases (#886), 1× gitleaks fixture (#884). |
-| 2026-05-14 | 6.5 | 9 | Closed 2× `curl \| sh` installers (#888). |
-| 2026-05-14 | 6.5 | 8 | Closed 1× `npm install -g npm@…` via Node 24 bump (#889). |
-| 2026-05-17 | 7.6 | 7 | v0.2.502 released; Cosign keyless signing live (#876 implementation landed in `security-release.yml` sbom job). |
-| 2026-05-17 | 7.6 | 6 | SLSA Release Attestation pipeline unblocked (PR #894 — 6 prior releases had failed identically). v0.2.502 backfilled with `.intoto.jsonl` + `.sig` + `.pem` triplet. `Signed-Releases` should bump from 3 to ~10 on next Scorecard re-scrape. |
-| 2026-05-17 | 7.6 | — | Added `MAINTAINERS.md` + `GOVERNANCE.md` at repo root. Provides the formal context for the `Code-Review` 0/30 score (solo maintainer) and unblocks the CII Best Practices badge application. |
-
-## Open work
-
-- **Apply for the OpenSSF Best Practices Badge** — see Bucket 3 above. All passing-tier criteria are now met (signed commits, CI, security policy, MIT license, MAINTAINERS.md, GOVERNANCE.md, RFC process documented).
-- **Re-trigger Scorecard after SLSA backfill propagates** — expected `Signed-Releases` 3 → 10.
-- **`harden-runner` block-mode adoption (#878)** — should tighten the `Token-Permissions` check further.
-- **Investigate `License` 9/10 false-positive** — repo is MIT (SPDX-compliant), Scorecard's penalty should not apply.
-- **Investigate `Branch-Protection` `-1`** — scanner internal error; manually verify with `gh api repos/:owner/:repo/branches/main/protection` and document.
-
-### Enabling Branch-Protection + Webhooks checks (one-time PAT setup)
-
-Scorecard's `Branch-Protection` and `Webhooks` checks require a
-fine-grained Personal Access Token with `Administration: read`
-scope. Without it both checks return `-1` ("internal error"). The
-workflow already wires this up — only the secret needs to be created.
-
-Steps (one-time, repo owner):
-
-1. Go to <https://github.com/settings/personal-access-tokens/new>
-2. **Resource owner**: `sebastienrousseau` · **Repository access**: only `sebastienrousseau/dotfiles`
-3. **Repository permissions** → `Administration: read-only` and `Metadata: read-only`
-4. **Expiration**: 1 year (set a calendar reminder to rotate; document the rotation in this file when done)
-5. Generate the token, copy it once
-6. Add as a secret named `SCORECARD_TOKEN` at <https://github.com/sebastienrousseau/dotfiles/settings/secrets/actions/new>
-7. Next Scorecard run (manual via `gh workflow run scorecard.yml` or weekly cron) picks it up automatically
-8. Expected effect: `Branch-Protection` `-1` → 10/10 if all rules are correctly configured; `Webhooks` `-1` → 10/10 (no webhooks present).
-
-The PAT secret is **optional**. When absent, the workflow falls back
-to `${{ github.token }}` and Scorecard continues to run, only with
-those two checks at `-1`. Adding the PAT cannot reduce any other check's
-score — it's a strict improvement.
-
-## Exceptions
-
-| Check | Expiry | Rationale |
-|---|---|---|
-| *(none currently)* | *—* | *—* |
-
-If you add an exception, include the check name, an expiry date
-(don't allow indefinite), and the rationale. Re-evaluate every quarter.
-
-## Refreshing this document
-
-```bash
-# Re-count open alerts:
-gh api 'repos/sebastienrousseau/dotfiles/code-scanning/alerts?state=open&per_page=50' \
-  --jq '[.[].rule.id] | group_by(.) | map({rule: .[0], count: length})'
-
-# Trigger Scorecard manually:
-gh workflow run scorecard.yml --ref main
-```
-
-If a new category appears, add a row to the matching bucket. If a
-remediation closes one of the rows above, delete the row.
-
-## References
-
-- `.github/workflows/scorecard.yml` — the scanner workflow (split into
-  `analysis` + `track-regression` jobs per #885).
-- [Scorecard project](https://github.com/ossf/scorecard).
-- [Scorecard checks reference](https://github.com/ossf/scorecard/blob/main/docs/checks.md).
-- Tracking issue [#869](https://github.com/sebastienrousseau/dotfiles/issues/869).