diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c5f9349..93362dd 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,9 +5,11 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "master" ]
+    branches:
+      - master
   pull_request:
-    branches: [ "master" ]
+    branches:
+      - master
   schedule:
     - cron: '28 4 * * 2'
 
@@ -15,79 +17,79 @@ on:
 permissions: read-all
 
 jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
-    permissions:
-      # required for all workflows
-      security-events: write
+    analyze:
+        name: Analyze (${{ matrix.language }})
+        # Runner size impacts CodeQL analysis time. To learn more, please see:
+        #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+        #   - https://gh.io/supported-runners-and-hardware-resources
+        #   - https://gh.io/using-larger-runners (GitHub.com only)
+        # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+        runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+        timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+        permissions:
+            # required for all workflows
+            security-events: write
 
-      # required to fetch internal or private CodeQL packs
-      packages: read
+            # required to fetch internal or private CodeQL packs
+            packages: read
 
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
+            # only required for workflows in private repositories
+            actions: read
+            contents: read
 
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - language: go
-          build-mode: autobuild
-        # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
-        # Use `c-cpp` to analyze code written in C, C++ or both
-        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
-        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
-        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
-        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
-        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-      with:
-        egress-policy: audit
+        strategy:
+            fail-fast: false
+            matrix:
+                include:
+                  - language: go
+                    build-mode: autobuild
+                  # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
+                  # Use `c-cpp` to analyze code written in C, C++ or both
+                  # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+                  # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+                  # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+                  # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+                  # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+                  # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+        steps:
+          - name: Harden Runner
+            uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+            with:
+                egress-policy: audit
 
-    - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+          - name: Checkout repository
+            uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
+          # Initializes the CodeQL tools for scanning.
+          - name: Initialize CodeQL
+            uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+            with:
+                languages: ${{ matrix.language }}
+                build-mode: ${{ matrix.build-mode }}
+                # If you wish to specify custom queries, you can do so here or in a config file.
+                # By default, queries listed here will override any specified in a config file.
+                # Prefix the list here with "+" to use these queries and those in the config file.
 
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
+                # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+                # queries: security-extended,security-and-quality
 
-    # If the analyze-step fails for one of the languages you are analyzing with
-    # "We were unable to automatically build your code", modify the matrix above
-    # to set the build mode to "manual" for that language. Then modify this step
-    # to build your code.
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-    - if: matrix.build-mode == 'manual'
-      shell: bash
-      run: |
-        echo 'If you are using a "manual" build mode for one or more of the' \
-          'languages you are analyzing, replace this with the commands to build' \
-          'your code, for example:'
-        echo '  make bootstrap'
-        echo '  make release'
-        exit 1
+          # If the analyze-step fails for one of the languages you are analyzing with
+          # "We were unable to automatically build your code", modify the matrix above
+          # to set the build mode to "manual" for that language. Then modify this step
+          # to build your code.
+          # ℹ️ Command-line programs to run using the OS shell.
+          # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+          - if: matrix.build-mode == 'manual'
+            shell: bash
+            run: |
+                echo 'If you are using a "manual" build mode for one or more of the' \
+                    'languages you are analyzing, replace this with the commands to build' \
+                    'your code, for example:'
+                echo '  make bootstrap'
+                echo '  make release'
+                exit 1
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
-      with:
-        category: "/language:${{matrix.language}}"
+          - name: Perform CodeQL Analysis
+            uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+            with:
+                category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/compliance.yml b/.github/workflows/compliance.yml
index e197f42..e05dd61 100644
--- a/.github/workflows/compliance.yml
+++ b/.github/workflows/compliance.yml
@@ -6,10 +6,10 @@ name: Compliance Checks
 on:
   push:
       branches:
-          - master
+        - master
   pull_request:
       branches:
-          - master
+        - master
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
@@ -37,82 +37,82 @@ jobs:
 
     CheckSignedOffCommit:
         if: >
-          github.event_name == 'push' &&
-          !contains(github.actor, '[bot]') &&
-          !contains(github.event.pusher.name, '[bot]') &&
-          github.event.pusher.name != 'web-flow'
+            github.event_name == 'push' &&
+            !contains(github.actor, '[bot]') &&
+            !contains(github.event.pusher.name, '[bot]') &&
+            github.event.pusher.name != 'web-flow'
         runs-on: ubuntu-latest
         permissions:
             contents: read
         steps:
-            - name: Harden Runner
-              uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-              with:
-                  egress-policy: audit
-
-            - name: Checkout
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-              with:
-                  fetch-depth: 0
-
-            - name: Determine pushed commits
-              id: range
-              run: |
-                  set -euo pipefail
-
-                  # Use GitHub-provided SHAs to build the range for this push
-                  BEFORE="${{ github.event.before }}"
-                  AFTER="${{ github.sha }}"
-
-                  if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]
-                  then
-                      # New branch or force push without previous SHA
-                      git rev-list --no-merges "$AFTER" > shas.txt
-                  else
-                      git rev-list --no-merges "$BEFORE".."$AFTER" > shas.txt
-                  fi
-
-            - name: Check for Signed-off-by
-              run: |
-                  set -euo pipefail
-                  missing=""
-
-                  while read -r sha
-                  do
-                      [ -n "$sha" ] || continue
-
-                      # Skip commits from bots
-                      committer_name=`git log --format=%cn -n 1 "$sha"`
-                      committer_email=`git log --format=%ce -n 1 "$sha"`
-                      if    echo "$committer_name" | grep -Fq '[bot]' \
-                         || [ "$committer_name" = "web-flow" ]        \
-                         || echo "$committer_email" | grep -Eqi 'noreply@github\.com$|@users\.noreply\.github\.com$'
-                      then
-                          echo "Skipping commit $sha from $committer_name <$committer_email>"
-                          continue
-                      fi
-
-                      msg=`git log --format=%B -n 1 "$sha"`
-
-                      if ! printf '%s' "$msg" | grep -Eqi '^[[:space:]]*Signed[- ]off[- ]by:'
-                      then
-                          echo "Commit $sha missing Signed-off-by"
-                          missing="true"
-
-                          echo "Committer name:           $committer_name"
-                          echo "Committer email:          $committer_email"
-                          echo "github.actor:             ${{ github.actor }}"
-                          echo "github.event.pusher.name: ${{ github.event.pusher.name }}"
-                      fi
-                  done < shas.txt
-
-                  if [ "$missing" = "true" ]
-                  then
-                      echo "DCO check failed on push"
-                      exit 1
-                  fi
-
-                  echo "All pushed commits are signed"
+          - name: Harden Runner
+            uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+            with:
+                egress-policy: audit
+
+          - name: Checkout
+            uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+            with:
+                fetch-depth: 0
+
+          - name: Determine pushed commits
+            id: range
+            run: |
+                set -euo pipefail
+
+                # Use GitHub-provided SHAs to build the range for this push
+                BEFORE="${{ github.event.before }}"
+                AFTER="${{ github.sha }}"
+
+                if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]
+                then
+                    # New branch or force push without previous SHA
+                    git rev-list --no-merges "$AFTER" > shas.txt
+                else
+                    git rev-list --no-merges "$BEFORE".."$AFTER" > shas.txt
+                fi
+
+          - name: Check for Signed-off-by
+            run: |
+                set -euo pipefail
+                missing=""
+
+                while read -r sha
+                do
+                    [ -n "$sha" ] || continue
+
+                    # Skip commits from bots
+                    committer_name=`git log --format=%cn -n 1 "$sha"`
+                    committer_email=`git log --format=%ce -n 1 "$sha"`
+                    if    echo "$committer_name" | grep -Fq '[bot]' \
+                       || [ "$committer_name" = "web-flow" ]        \
+                       || echo "$committer_email" | grep -Eqi 'noreply@github\.com$|@users\.noreply\.github\.com$'
+                    then
+                        echo "Skipping commit $sha from $committer_name <$committer_email>"
+                        continue
+                    fi
+
+                    msg=`git log --format=%B -n 1 "$sha"`
+
+                    if ! printf '%s' "$msg" | grep -Eqi '^[[:space:]]*Signed[- ]off[- ]by:'
+                    then
+                        echo "Commit $sha missing Signed-off-by"
+                        missing="true"
+
+                        echo "Committer name:           $committer_name"
+                        echo "Committer email:          $committer_email"
+                        echo "github.actor:             ${{ github.actor }}"
+                        echo "github.event.pusher.name: ${{ github.event.pusher.name }}"
+                    fi
+                done < shas.txt
+
+                if [ "$missing" = "true" ]
+                then
+                    echo "DCO check failed on push"
+                    exit 1
+                fi
+
+                echo "All pushed commits are signed"
 
     CheckSignedOffPullRequest:
         if: github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'bypass-dco')
@@ -124,25 +124,25 @@ jobs:
           - name: Harden Runner
             uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
             with:
-              egress-policy: audit
+                egress-policy: audit
 
           - name: Checkout
             uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
             with:
-              fetch-depth: 0
+                fetch-depth: 0
 
           - name: Get PR commits
             env:
-              GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
             run: |
-              set -euo pipefail
-              gh --version
-              jq --version
-
-              # Fetch all commits of the PR with pagination and extract SHAs
-              gh api -H "Accept: application/vnd.github+json" --paginate \
-                repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits \
-                | jq -r '.[].sha' > shas.txt
+                set -euo pipefail
+                gh --version
+                jq --version
+
+                # Fetch all commits of the PR with pagination and extract SHAs
+                gh api -H "Accept: application/vnd.github+json" --paginate \
+                    repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits \
+                    | jq -r '.[].sha' > shas.txt
 
           - name: Check for Signed-off-by
             run: |
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 3023cf1..8fc25e7 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -2,22 +2,23 @@
 # SPDX-License-Identifier: MPL-2.0
 
 name: 'Dependency Review'
-on: [pull_request]
+on:
+  - pull_request
 
 permissions:
   contents: read
 
 jobs:
-  dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
+    dependency-review:
+        runs-on: ubuntu-latest
+        steps:
+          - name: Harden Runner
+            uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+            with:
+                egress-policy: audit
 
-      - name: 'Checkout Repository'
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+          - name: 'Checkout Repository'
+            uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
+          - name: 'Dependency Review'
+            uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7b07ce6..52ee35d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,7 +6,7 @@ name: Release
 on:
     release:
         types:
-            - published
+          - published
 
 permissions: read-all
 
@@ -20,36 +20,36 @@ jobs:
             contents: write
         runs-on: ubuntu-latest
         steps:
-            - name: Harden Runner
-              uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-              with:
-                  egress-policy: audit
-
-            - name: Checkout
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-              with:
-                  fetch-depth: 0
-                  ref: ${{ github.event.release.tag_name }}
-
-            - name: Generate source archive
-              shell: bash
-              run: |
-                  set -euo pipefail
-
-                  TAG=`echo "${{ github.event.release.tag_name }}" | sed 's/\//-/g'`
-                  git archive \
+          - name: Harden Runner
+            uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+            with:
+                egress-policy: audit
+
+          - name: Checkout
+            uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+            with:
+                fetch-depth: 0
+                ref: ${{ github.event.release.tag_name }}
+
+          - name: Generate source archive
+            shell: bash
+            run: |
+                set -euo pipefail
+
+                TAG=`echo "${{ github.event.release.tag_name }}" | sed 's/\//-/g'`
+                git archive \
                     --format=tar.gz \
                     --prefix="midgard-src-${TAG}/" \
                     --output="midgard-src-${TAG}.tar.gz" \
                     "${{ github.event.release.tag_name }}"
 
-            - name: Upload Release (via GitHub CLI)
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-              shell: bash
-              run: |
-                  set -euo pipefail
-                  gh release upload "${{ github.event.release.tag_name }}" midgard-src-*.tar.gz --clobber
+          - name: Upload Release (via GitHub CLI)
+            env:
+                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+            shell: bash
+            run: |
+                set -euo pipefail
+                gh release upload "${{ github.event.release.tag_name }}" midgard-src-*.tar.gz --clobber
 
     ChecksumReleaseAssets:
         needs: Build
@@ -58,46 +58,46 @@ jobs:
         outputs:
             hashBase64File: ${{ steps.hashes.outputs.handle }}
         steps:
-            - name: Harden Runner
-              uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-              with:
-                  egress-policy: audit
-
-            - name: Checkout
-              uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-              with:
-                  fetch-depth: 1
-
-            - name: Download all release assets via GitHub CLI
-              env:
-                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-              run: |
-                  set -euo pipefail
-
-                  mkdir -p release-assets
-                  cd release-assets
-                  # gets all assets of the release
-                  gh release download "${{ github.event.release.tag_name }}" --clobber
-                  echo "Downloaded assets:"
-                  ls -lah
-
-            - name: Generate Checksums
-              working-directory: release-assets
-              run: |
-                  set -euo pipefail
-
-                  # Robustly hash all regular files in this directory, then base64 and write via tee.
-                  LC_ALL=C find . -maxdepth 1 -type f -printf '%P\0' \
-                    | sort -z \
-                    | xargs -0 sha256sum -- \
-                    | base64 -w0 \
-                    > check.sha256
-
-            - name: Upload Checksums
-              id: hashes
-              uses: slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # 2.1.0
-              with:
-                  path: release-assets/check.sha256
+          - name: Harden Runner
+            uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+            with:
+                egress-policy: audit
+
+          - name: Checkout
+            uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+            with:
+                fetch-depth: 1
+
+          - name: Download all release assets via GitHub CLI
+            env:
+                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+            run: |
+                set -euo pipefail
+
+                mkdir -p release-assets
+                cd release-assets
+                # gets all assets of the release
+                gh release download "${{ github.event.release.tag_name }}" --clobber
+                echo "Downloaded assets:"
+                ls -lah
+
+          - name: Generate Checksums
+            working-directory: release-assets
+            run: |
+                set -euo pipefail
+
+                # Robustly hash all regular files in this directory, then base64 and write via tee.
+                LC_ALL=C find . -maxdepth 1 -type f -printf '%P\0' \
+                  | sort -z \
+                  | xargs -0 sha256sum -- \
+                  | base64 -w0 \
+                  > check.sha256
+
+          - name: Upload Checksums
+            id: hashes
+            uses: slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # 2.1.0
+            with:
+                path: release-assets/check.sha256
 
     AssetProvenance:
         permissions:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d2f8484..b90a668 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -3,62 +3,62 @@
 
 name: Scorecard supply-chain security
 on:
-  # For Branch-Protection check. Only the default branch is supported. See
-  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
-  branch_protection_rule:
-  # To guarantee Maintained check is occasionally updated. See
-  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
-  schedule:
-    - cron: '36 3 * * 2'
-  push:
-    branches: [ "master" ]
+    # For Branch-Protection check. Only the default branch is supported. See
+    # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+    branch_protection_rule:
+    # To guarantee Maintained check is occasionally updated. See
+    # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+    schedule:
+      - cron: '36 3 * * 2'
+    push:
+        branches: [ "master" ]
 
 # Declare default permissions as read only.
 permissions: read-all
 
 jobs:
-  analysis:
-    name: Scorecard analysis
-    runs-on: ubuntu-latest
-    permissions:
-      # Needed to upload the results to code-scanning dashboard.
-      security-events: write
-      # Needed to publish results and get a badge (see publish_results below).
-      id-token: write
-      # Uncomment the permissions below if installing in a private repository.
-      # contents: read
-      # actions: read
+    analysis:
+        name: Scorecard analysis
+        runs-on: ubuntu-latest
+        permissions:
+            # Needed to upload the results to code-scanning dashboard.
+            security-events: write
+            # Needed to publish results and get a badge (see publish_results below).
+            id-token: write
+            # Uncomment the permissions below if installing in a private repository.
+            # contents: read
+            # actions: read
 
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
+        steps:
+          - name: Harden Runner
+            uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+            with:
+                egress-policy: audit
 
-      - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          persist-credentials: false
+          - name: "Checkout code"
+            uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+            with:
+                persist-credentials: false
 
-      - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
-          # - you want to enable the Branch-Protection check on a *public* repository, or
-          # - you are installing Scorecard on a *private* repository
-          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
-          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+          - name: "Run analysis"
+            uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+            with:
+                results_file: results.sarif
+                results_format: sarif
+                # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+                # - you want to enable the Branch-Protection check on a *public* repository, or
+                # - you are installing Scorecard on a *private* repository
+                # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+                # repo_token: ${{ secrets.SCORECARD_TOKEN }}
 
-          # Public repositories:
-          #   - Publish results to OpenSSF REST API for easy access by consumers
-          #   - Allows the repository to include the Scorecard badge.
-          #   - See https://github.com/ossf/scorecard-action#publishing-results.
-          # For private repositories:
-          #   - `publish_results` will always be set to `false`, regardless
-          #     of the value entered here.
-          publish_results: true
+                # Public repositories:
+                #   - Publish results to OpenSSF REST API for easy access by consumers
+                #   - Allows the repository to include the Scorecard badge.
+                #   - See https://github.com/ossf/scorecard-action#publishing-results.
+                # For private repositories:
+                #   - `publish_results` will always be set to `false`, regardless
+                #     of the value entered here.
+                publish_results: true
 
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
@@ -69,9 +69,9 @@ jobs:
           path: results.sarif
           retention-days: 5
 
-      # Upload the results to GitHub's code scanning dashboard (optional).
-      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
-      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
-        with:
-          sarif_file: results.sarif
+          # Upload the results to GitHub's code scanning dashboard (optional).
+          # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+          - name: "Upload to code-scanning"
+            uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
+            with:
+                sarif_file: results.sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index b004338..6cf3b83 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -23,7 +23,7 @@ jobs:
           - name: Harden Runner
             uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
             with:
-              egress-policy: audit
+                egress-policy: audit
 
           - name: Checkout code
             uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -38,7 +38,7 @@ jobs:
                 severity: 'CRITICAL'
 
           - name: Upload Trivy scan results to GitHub Security tab
-            uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
+            uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
             with:
                 sarif_file: 'trivy-results.sarif'
 
@@ -54,7 +54,7 @@ jobs:
           - name: Harden Runner
             uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
             with:
-              egress-policy: audit
+                egress-policy: audit
 
           - name: Checkout
             uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -82,6 +82,6 @@ jobs:
 
           - name: Upload govolncheck results to GitHub Security tab
             if: ${{ steps.PrintSarif.outputs.hasResults == 'true' }}
-            uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v4.30.9
+            uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
             with:
                 sarif_file: govulncheck-results.sarif