ci: add OpenSSF Scorecard, SBOM, and release signing workflows (#1141)

- scorecard.yml: weekly Scorecard analysis with SARIF upload
- sbom.yml: SPDX SBOM generation on release via syft
- sign-release.yml: cosign/sigstore signing of release artifacts

Closes #1141

Author: Dmitrii Vasilev

.github/workflows/sbom.yml

@@ -0,0 +1,32 @@
+# SPDX SBOM generation on release
+# Issue: #1141
+name: Generate SBOM
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  sbom:
+    name: Generate and upload SBOM
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Generate SBOM with syft
+        uses: anchore/sbom-action@v0
+        with:
+          format: spdx-json
+          output-file: trinity-sbom.spdx.json
+          artifact-name: trinity-sbom
+
+      - name: Upload SBOM to release
+        uses: softprops/action-gh-release@v2
+        if: github.event_name == 'release'
+        with:
+          files: trinity-sbom.spdx.json

.github/workflows/scorecard.yml

@@ -0,0 +1,47 @@
+# OpenSSF Scorecard workflow
+# See: https://github.com/ossf/scorecard
+# Issue: #1141
+name: OpenSSF Scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '0 9 * * 1'
+  push:
+    branches: [master, main]
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@v2.3.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Scorecard SARIF
+          path: results.sarif
+
+      - name: Upload to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

.github/workflows/sign-release.yml

@@ -0,0 +1,42 @@
+# Cosign/sigstore release artifact signing
+# Issue: #1141
+name: Sign Release
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  id-token: write
+  packages: write
+
+jobs:
+  sign:
+    name: Sign release artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3.5.0
+
+      - name: Download release assets
+        uses: robinraju/release-downloader@v1.10
+        with:
+          latest: true
+          fileName: '*'
+          tarBall: true
+          zipBall: true
+          out-file-path: 'assets'
+
+      - name: Sign artifacts with cosign
+        run: |
+          for f in assets/*; do
+            cosign sign-blob --yes "$f" --output-signature="${f}.sig" --output-certificate="${f}.cert"
+          done
+        env:
+          COSIGN_EXPERIMENTAL: 1
+
+      - name: Upload signatures to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: assets/*.sig,assets/*.cert

.trinity/current_task/activity.md

@@ -384,3 +384,7 @@
 - **Commit:** spec: fix gf16_round rounding comment + broken test (Zig @round = ties-away, not ties-even)
 - **Files:** .claude/scheduled_tasks.lock,.trinity/current_task/.commit_count,.trinity/current_task/session_log.jsonl,.trinity/seals/compiler_seal_2026_06_16.txt,NOW.md~Stashed changes,NOW.md~Stashed changes_0,NOW.md~Stashed changes_1,NOW_FULL.md,bootstrap/src/compiler.rs,bootstrap/src/proxy.rs,bootstrap/src/ternary/mod.rs,bootstrap/stage0/FROZEN_HASH,cli/flash-spi/src/main.rs,docs/WAVE_LOOP_REPORT_2026_06_16.md,docs/WAVE_LOOP_REPORT_2026_06_16_ITER2.md,docs/WAVE_LOOP_REPORT_2026_06_16_ITER3.md,docs/WAVE_LOOP_REPORT_2026_06_16_ITER4.md,docs/gf14_conformance_blocker.md,docs/retroactive_issue_mapping_2026_06_16.md,fpga/tools/bscan_spi_xc7a100t_fgg676.bit
 
+## 2026-06-16T13:20:48Z — trinity-rust-rings
+- **Commit:** fix(bootstrap): resolve compiler.rs duplicate impl, proxy test cfg, ternary round-trip, flash-spi opts
+- **Files:** .github/workflows/sbom.yml,.github/workflows/scorecard.yml,.github/workflows/sign-release.yml
+