[cdalar]

The published Scorecard result is 5.7 and has not refreshed since 2026-07-08. This PR lands the changes that need no settings, tokens or second reviewer.

Changes

• Scorecard publishing — scorecard.yml moves from onctl-4 to ubuntu-latest. Publishing is only accepted from GitHub-hosted runners, which is the likely reason the badge went stale.
• Token-Permissions — every workflow now has a read-only top-level permissions block. Write scopes moved to the jobs that need them: the goreleaser jobs keep contents/packages: write, and in edge.yml only publish keeps contents: write.
• Pinned-Dependencies
  • All actions are pinned to commit SHAs with the version in a trailing comment, so Dependabot keeps updating them.
  • govulncheck is pinned to the v1.8.0 commit instead of @latest.
  • The curl | sh quill installer in both goreleaser workflows is replaced by a download of quill 0.7.1 verified against its SHA-256.
  • The devcontainer base image is pinned by digest, with a Dependabot docker entry to keep it fresh.
• Security-Policy — new SECURITY.md.
• Fuzzing — FuzzAllocateFCIP in pkg/cloud/fc_test.go.

Verification

• go test ./pkg/cloud passes; the fuzz target ran 30s (324k execs) with no failures.
• The new quill install step was run locally on darwin/arm64: checksum OK, quill version reports 0.7.1.
• actionlint reports nothing new (only the existing onctl-4 label and SC2174 warnings).

Not verified / needs a decision

• Release workflows are not exercised by PR checks. Running goreleaser (self-hosted test) from this branch against an existing tag would confirm the quill and permission changes before the next real release.
• SECURITY.md points at GitHub private vulnerability reporting, which is currently disabled on this repo. Enable it under Settings → Security before merging, or swap the link for another contact.
• govulncheck and snyk/actions (pinned to a master commit, it has no release tags) will not be bumped by Dependabot; they need a manual bump now and then.
• quill moves from "whatever the installer serves" to 0.7.1, which was the latest release at the time of writing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FM1Tvz8jDNmhot3etAateY

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 36.93%. Comparing base (194292d) to head (8d3a550).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1159      +/-   ##
==========================================
+ Coverage   36.89%   36.93%   +0.03%     
==========================================
  Files          51       51              
  Lines        5656     5656              
==========================================
+ Hits         2087     2089       +2     
+ Misses       3569     3567       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.