Review SCM files and security updates (#5)

- SHA-pin trufflehog, editorconfig-checker, codeql-action,
scorecard-action
- Fix security.txt expiry date placeholder (RFC 9116 compliance)
- Fix provenance.json version/date placeholders
- Update RSR_COMPLIANCE.adoc with correct status and roadmap
- Update STATE.scm with security-review session

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -65,7 +65,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -94,6 +94,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/quality.yml

@@ -12,7 +12,7 @@ jobs:
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@05cccb53bc9e13bc6d17997db5a6bcc3df44bf2f # v3.92.3
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -29,7 +29,7 @@ jobs:
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@main
+        uses: editorconfig-checker/action-editorconfig-checker@4b6cd6190d435e7e084fb35e36a096e98506f7b9 # v2.1.0
         continue-on-error: true
 
   docs:

.github/workflows/scorecard.yml

@@ -19,12 +19,12 @@ jobs:
           persist-credentials: false
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
         with:
           sarif_file: results.sarif

.well-known/provenance.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://hyperpolymath.org/schemas/provenance-v1.json",
   "project": "rpa-elysium",
-  "version": "{{VERSION}}",
+  "version": "0.1.0",
   "canonical": "https://github.com/hyperpolymath/rpa-elysium",
   "singleSourceOfTruth": "github",
   "mirrors": [
@@ -36,8 +36,8 @@
     "attestation": "sigstore"
   },
   "metadata": {
-    "created": "{{CREATED_DATE}}",
-    "updated": "{{UPDATED_DATE}}",
+    "created": "2025-12-15",
+    "updated": "2025-12-17",
     "generator": "conative-gating"
   }
 }

.well-known/security.txt

@@ -2,7 +2,7 @@
 # https://securitytxt.org/
 
 Contact: security@hyperpolymath.org
-Expires: {{EXPIRY_DATE}}
+Expires: 2026-12-17T00:00:00.000Z
 Encryption: https://hyperpolymath.org/gpg/security.asc
 Preferred-Languages: en, nl
 Canonical: https://github.com/hyperpolymath/rpa-elysium/.well-known/security.txt

RSR_COMPLIANCE.adoc

@@ -13,10 +13,10 @@ This document describes the Rhodium Standard Repository (RSR) compliance status
 |Attribute |Value
 
 |Project |rpa-elysium
-|Primary Language |unknown
-|RSR Tier |N/A
-|Compliance Status |Review Needed
-|Last Updated |2025-12-10
+|Primary Language |Guile Scheme
+|RSR Tier |Tier 2
+|Compliance Status |Gold (Partial)
+|Last Updated |2025-12-17
 |===
 
 == Language Tier Classification
@@ -46,14 +46,15 @@ This document describes the Rhodium Standard Repository (RSR) compliance status
 |===
 |Requirement |Status |Notes
 
-|Primary language is Tier 1/2 |✓ |unknown
+|Primary language is Tier 1/2 |✓ |Guile Scheme (Tier 2)
 |No restricted languages outside exemptions |✓ |
 |.editorconfig present |✓ |
-|.well-known/ directory |✓ |
-|justfile present |✗ |
-|LICENSE.txt (AGPL + Palimpsest) |✗ |
-|Containerfile present |✗ |
-|flake.nix present |✗ |
+|.well-known/ directory |✓ |RFC 9116 compliant
+|justfile present |✓ |Tasks need implementation
+|LICENSE.txt (AGPL + Palimpsest) |✓ |Dual license
+|SHA-pinned GitHub Actions |✓ |All actions pinned
+|Containerfile present |✗ |Roadmap item
+|flake.nix present |✗ |Nix fallback (optional)
 |===
 
 == Exemptions
@@ -62,9 +63,46 @@ None
 
 == Action Items
 
-* Add justfile
-* Add Containerfile
-* Add flake.nix
+* [x] Add justfile
+* [ ] Implement justfile tasks (build, test, clean, fmt, lint)
+* [ ] Add Containerfile
+* [ ] Add flake.nix (optional Nix fallback)
+* [ ] Add core RPA functionality
+
+== Roadmap
+
+=== Phase 1: Foundation (v0.1) - Current
+* [x] RSR compliance framework
+* [x] Security hardening (SHA-pinned actions)
+* [x] CI/CD workflows (10 workflows)
+* [x] RFC 9116 security.txt
+* [x] Multi-platform mirroring
+* [ ] Implement justfile tasks
+
+=== Phase 2: Core RPA (v0.2)
+* [ ] Design RPA architecture
+* [ ] Browser automation module (Rust + WebDriver)
+* [ ] Process orchestration (Guile Scheme)
+* [ ] Configuration DSL (Guile/Nickel)
+* [ ] Basic tests and examples
+
+=== Phase 3: Integration (v0.3)
+* [ ] Add Containerfile (OCI container)
+* [ ] Guix package testing
+* [ ] API documentation
+* [ ] Workflow templates
+
+=== Phase 4: Advanced Features (v0.4)
+* [ ] Machine learning integration (if needed)
+* [ ] Distributed execution
+* [ ] Monitoring and logging
+* [ ] Production hardening
+
+=== Phase 5: Release (v1.0)
+* [ ] Full documentation
+* [ ] Security audit
+* [ ] Performance benchmarks
+* [ ] Release to Guix channel
 
 == References
 

STATE.scm

@@ -3,20 +3,22 @@
 ;; SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
 
 (define metadata
-  '((version . "0.1.0") (updated . "2025-12-15") (project . "rpa-elysium")))
+  '((version . "0.1.0") (updated . "2025-12-17") (project . "rpa-elysium")))
 
 (define current-position
   '((phase . "v0.1 - Initial Setup")
-    (overall-completion . 25)
-    (components ((rsr-compliance ((status . "complete") (completion . 100)))))))
+    (overall-completion . 30)
+    (components ((rsr-compliance ((status . "complete") (completion . 100)))
+                 (security-hardening ((status . "complete") (completion . 100)))))))
 
 (define blockers-and-issues '((critical ()) (high-priority ())))
 
 (define critical-next-actions
   '((immediate (("Verify CI/CD" . high))) (this-week (("Expand tests" . medium)))))
 
 (define session-history
-  '((snapshots ((date . "2025-12-15") (session . "initial") (notes . "SCM files added")))))
+  '((snapshots ((date . "2025-12-15") (session . "initial") (notes . "SCM files added"))
+               ((date . "2025-12-17") (session . "security-review") (notes . "SHA-pinned actions, fixed placeholders")))))
 
 (define state-summary
-  '((project . "rpa-elysium") (completion . 25) (blockers . 0) (updated . "2025-12-15")))
+  '((project . "rpa-elysium") (completion . 30) (blockers . 0) (updated . "2025-12-17")))