chore: openssf scorecard hardening; bump 0.2.6

Author: franzos

.github/workflows/ci.yml

@@ -6,17 +6,20 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
 
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           components: clippy
       - name: Install system dependencies
@@ -27,21 +30,21 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y libclang-dev
       - run: cargo test --workspace --all-features
 
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           components: rustfmt
       - run: cargo fmt --check

.github/workflows/publish.yml

@@ -5,15 +5,18 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           submodules: recursive
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y libclang-dev
@@ -22,6 +25,6 @@ jobs:
         run: cargo test --workspace --all-features
 
       - name: Publish to crates.io
-        uses: katyo/publish-crates@v2
+        uses: katyo/publish-crates@02cc2f1ad653fb25c7d1ff9eb590a8a50d06186b # v2
         with:
           registry-token: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/scorecard.yml

@@ -0,0 +1,47 @@
+name: Scorecard
+
+# Runs OpenSSF Scorecard against the default branch and publishes the result so
+# the README badge (api.scorecard.dev) has something to read. Publishing is what
+# populates the badge; without publish_results the badge stays "unknown".
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "20 7 * * 2"
+  push:
+    branches: [master]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload the SARIF to the Security tab
+      id-token: write # sign the published results (publish_results)
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # Required for the public badge + api.scorecard.dev entry.
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        with:
+          sarif_file: results.sarif

CHANGELOG.md

@@ -1,3 +1,14 @@
+## [0.2.6] - 2026-07-01
+
+### Added
+- OpenSSF Scorecard workflow and README badge
+- `SECURITY.md` with private vulnerability reporting
+- `renovate.json` for dependency updates
+
+### Changed
+- Workflow actions pinned to SHAs; least-privilege permissions
+- Bumped `rustls-webpki`, `anyhow`, `memmap2` to clear advisories
+
 ## [0.2.5] - 2026-05-25
 
 ### Fixed

Cargo.lock

@@ -1,6 +1,7 @@
 # litehtml-rs
 
 [![crates.io](https://img.shields.io/crates/v/litehtml.svg)](https://crates.io/crates/litehtml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/franzos/litehtml-rs/badge)](https://scorecard.dev/viewer/?uri=github.com/franzos/litehtml-rs)
 
 Rust bindings for [litehtml](https://github.com/litehtml/litehtml) -- a lightweight HTML/CSS rendering engine. It handles email HTML and simple, content-focused websites well (think [bettermotherfuckingwebsite.com](http://bettermotherfuckingwebsite.com/)), but modern JS-heavy sites with megabytes of CSS will be slow or render incorrectly.
 

README.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+litehtml-rs wraps a C++ HTML/CSS rendering engine and is often pointed at
+untrusted input (email HTML, arbitrary web pages), so I take reports about it
+seriously. Thanks for taking the time to look.
+
+## Supported versions
+
+This is pre-1.0 software and moves fast. Only the latest tagged release and the
+`master` branch get security fixes. There are no backports to older `0.x` tags,
+so if you're running an older build, the fix is to upgrade.
+
+| Version        | Supported |
+| -------------- | --------- |
+| latest release | yes       |
+| `master`       | yes       |
+| older `0.x`    | no        |
+
+## Reporting a vulnerability
+
+Please report privately, not through a public issue or pull request.
+
+- Email: mail@gofranz.com
+- If you use GitHub, you can also open a private advisory via the repository's
+  Security tab ("Report a vulnerability").
+
+Useful things to include, as far as you have them:
+
+- what the issue is and the impact you think it has
+- the affected version or commit
+- steps to reproduce, or a proof of concept (a minimal HTML/CSS input that
+  triggers the issue is ideal)
+- any logs or backtraces that help me confirm it
+
+## What to expect
+
+I'll acknowledge your report, confirm whether I can reproduce it, and keep you
+updated as I work on a fix. Once it's resolved I'm happy to credit you in the
+release notes, or keep you anonymous if you'd rather. Please give me a chance to
+ship a fix before disclosing publicly.
+
+## Scope
+
+The Rust code in this repository (the `litehtml` and `litehtml-sys` crates) is
+in scope, including the FFI boundary and the C wrapper. Bugs in upstream
+litehtml itself are better reported to
+[litehtml/litehtml](https://github.com/litehtml/litehtml), though I do want to
+hear about it if such a bug is reachable through how these bindings use it (for
+example a crash or memory-safety issue exposed across the safe Rust API).

SECURITY.md

@@ -1,6 +1,6 @@
 [package]
 name = "litehtml"
-version = "0.2.5"
+version = "0.2.6"
 edition = "2021"
 license = "MIT"
 authors = ["Franz Geffke <mail@gofranz.com>"]

litehtml/Cargo.toml

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:best-practices",
+    "schedule:weekly"
+  ],
+  "labels": ["dependencies"],
+  "dependencyDashboard": true,
+  "dependencyDashboardApproval": true,
+  "packageRules": [
+    {
+      "description": "One grouped PR for non-major Rust crate bumps",
+      "matchManagers": ["cargo"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "cargo non-major"
+    },
+    {
+      "description": "One grouped PR for GitHub Actions (keeps SHA pins + version comments fresh)",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    }
+  ]
+}