chore: fill or remove RSR template placeholders

[hyperpolymath]

openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them, with no invention.

• Deleted the TEMPLATE INSTRUCTIONS (delete this block before publishing) comment — the template says to delete it, and it is where every legend line lived, so a large share of the reported tokens were the file documenting its own placeholders.
• Filled what the repository itself supplies: owner and repo from the git remote, project name, year, forge, main branch, contact email.
• Removed PGP and website lines. https://github.com/<user>.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasn't uploaded any GPG keys". No key is published for either account, and commit signing here is SSH — unrelated. The template sanctions this: "Optional: Remove sections that don't apply (e.g. PGP if you don't use it)."\n\nA security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption.\n\nWhere applicable, this also fixes a misrouted advisory URL. A previous just init copied already-filled templates out of squisher-corpus, so 51 repositories directed vulnerability reports to hyperpolymath/squisher-corpus — a repository unrelated to the code being reported, meaning the affected maintainer never saw them. Repointed from this repository's own git remote.

---

Summary by Gitar

• Security and Workflow Updates:
  • Added actions: read permission to boj-build.yml and multiple CI workflow files for security compliance.
  • Removed duplicate GOVERNANCE.adoc file and updated SECURITY.md configuration.

_{This will update automatically on new commits.}

[gitar-bot]

CI failed: Multiple CI failures including deprecated actions/cache usage, missing Dockerfile in root, missing npm lockfiles for TypeScript jobs, a Deno lockfile parsing error, and a Hypatia governance violation for banned ReScript files.

Overview

Analysis of 7 CI logs revealed 6 distinct failure patterns across configuration, build, dependency, and tooling categories. All failures are related to repository setup, missing files, or governance constraints.

Failures

Deprecated actions/cache Version (confidence: high)

• Type: configuration
• Affected jobs: 90326207699
• Related to change: yes
• Root cause: One or more workflow files use a deprecated version of actions/cache which has been shut down by GitHub Actions.
• Suggested fix: Update all instances of actions/cache under .github/workflows/ to use v4 (actions/cache@v4).

Missing Dockerfile (confidence: high)

• Type: build
• Affected jobs: 90326207460
• Related to change: unclear
• Root cause: Docker buildx failed because the Dockerfile (open Dockerfile: no such file or directory) could not be found in the repository root.
• Suggested fix: Ensure a Dockerfile exists in the repository root or adjust the build context/file path parameters in the workflow configuration.

Missing Npm Lockfiles (confidence: high)

• Type: dependency
• Affected jobs: 90326207523, 90326207611
• Related to change: yes
• Root cause: The actions/setup-node action requires a lock file (package-lock.json, npm-shrinkwrap.json, or yarn.lock) in the repository, but none was found.
• Suggested fix: Generate and commit a package-lock.json or yarn.lock file in the repository root.

Hypatia Governance Banned Language Files (confidence: high)

• Type: tooling
• Affected jobs: 90326213038
• Related to change: yes
• Root cause: The governance check cicd_rules/banned_language_file detected banned ReScript files (e.g., src/visualization/geo_viz.res) without required exemptions or pragmas.
• Suggested fix: Migrate the ReScript files to AffineScript or add an appropriate # hypatia:ignore cicd_rules/banned_language_file pragma / exemption.

Deno Lockfile Error (confidence: high)

• Type: build
• Affected jobs: 90326208295, 90326207559
• Related to change: yes
• Root cause: The deno.lock file format is incompatible with the Deno version being used or is malformed/corrupted.
• Suggested fix: Regenerate the lockfile by running deno cache --reload or updating/re-creating deno.lock.

Summary

• Change-related failures: 5 failures involving missing lockfiles, governance violations, deprecated actions/cache usage, and Deno lockfile formatting issues.
• Infrastructure/flaky failures: 0 infrastructure or flaky failures.
• Recommended action: Update workflow cache actions to v4, add missing npm lockfiles and a root Dockerfile, regenerate deno.lock, and resolve or exempt the banned ReScript files per repository governance policies.

Code Review 👍 Approved with suggestions 0 resolved / 1 findings

Replaces template placeholders across documentation and adds read permissions to CI workflows for OpenSSF compliance. Consider removing the dangling '[PGP fingerprint not set]' row to complete the PGP section cleanup.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

💡 Quality: PGP removal incomplete: dangling '[PGP fingerprint not set]' row

📄 SECURITY.md:41-49

The PR summary states PGP lines were removed because no key exists, yet SECURITY.md still contains an 'Encrypted Email' section with a Fingerprint row reading [PGP fingerprint not set]. This is exactly the situation the PR aims to avoid — directing a researcher toward encryption with a non-existent key — and it also leaves a placeholder-style value in a compliance-checked file. Remove the Fingerprint row (and rename the 'Encrypted Email' heading to plain 'Email') so the section matches the stated intent.

🤖 Prompt for agents

Code Review: Replaces template placeholders across documentation and adds read permissions to CI workflows for OpenSSF compliance. Consider removing the dangling '[PGP fingerprint not set]' row to complete the PGP section cleanup.

1. 💡 Quality: PGP removal incomplete: dangling '[PGP fingerprint not set]' row
   Files: SECURITY.md:41-49

   The PR summary states PGP lines were removed because no key exists, yet SECURITY.md still contains an 'Encrypted Email' section with a Fingerprint row reading `[PGP fingerprint not set]`. This is exactly the situation the PR aims to avoid — directing a researcher toward encryption with a non-existent key — and it also leaves a placeholder-style value in a compliance-checked file. Remove the Fingerprint row (and rename the 'Encrypted Email' heading to plain 'Email') so the section matches the stated intent.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)