ci(security): fix scorecard publication [skip changelog]

Author: liuyuran02

.github/workflows/codeql.yml

@@ -39,23 +39,23 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-          queries: security-extended,security-and-quality
-
       - name: Set up Go
         if: matrix.language == 'go'
         uses: actions/setup-go@v5
         with:
           go-version: "1.22"
           cache-dependency-path: sdk/go/go.mod
 
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+
       - name: Build Go SDK
         if: matrix.language == 'go'
         working-directory: sdk/go
         run: go test ./...
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/scorecard.yml

@@ -13,9 +13,6 @@ permissions:
   id-token: write
   security-events: write
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 concurrency:
   group: scorecard-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -38,6 +35,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: scorecard.sarif

SECURITY.md

@@ -8,7 +8,11 @@ Security fixes target the current `main` branch and the latest tagged release. O
 
 ## Reporting a Vulnerability
 
-Use GitHub Private Vulnerability Reporting from the repository's **Security** tab when it is enabled. Include:
+Use GitHub Private Vulnerability Reporting from the repository's **Security** tab when it is enabled:
+
+https://github.com/Kickflip73/agent-communication-protocol/security/advisories/new
+
+Include:
 
 - A short description of the issue and affected component
 - Reproduction steps or a proof of concept
@@ -25,4 +29,6 @@ Please avoid opening public GitHub issues for vulnerabilities until a maintainer
 
 ## Security Documentation
 
-See [docs/security.md](docs/security.md) for the relay security model, identity notes, and operational hardening guidance.
+See the published security model for relay identity notes and operational hardening guidance:
+
+https://kickflip73.github.io/agent-communication-protocol/security/