only-cli d0516a6a4c harden CI: CodeQL, dependency review, npm provenance, OpenSSF Scorecard ...

Adds free security tooling for a public npm CLI: CodeQL static analysis
on push/PR plus a weekly scan, a Dependency Review check that blocks PRs
introducing vulnerable or malicious packages, --provenance on npm publish
(cheap given existing OIDC trusted publishing), and a weekly OpenSSF
Scorecard run with a README badge.

2026-08-19 16:21:46 -04:00

..

workflows

harden CI: CodeQL, dependency review, npm provenance, OpenSSF Scorecard

2026-08-19 16:21:46 -04:00

dependabot.yml

dependabot: weekly update PRs for npm deps and CI actions

2026-08-18 09:42:30 -04:00