chore: estate-wide security compliance

hyperpolymath · hyperpolymath · commit 0ced540e613d · 2026-07-26T14:53:39.000+01:00
diff --git a/.github/funding.yml b/.github/funding.yml
@@ -0,0 +1,4 @@
+# Funding Configuration
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-custom-fields/displaying-a-sponsor-button-in-your-repository
+
+github: metadatastician
diff --git a/.github/workflows/affinescript-verify.yml b/.github/workflows/affinescript-verify.yml
@@ -19,6 +19,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 # Compile-verifies changed `.affine` files with the canonical AffineScript
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
@@ -13,6 +13,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/changelog-reusable.yml b/.github/workflows/changelog-reusable.yml
@@ -48,6 +48,7 @@ on:
         default: '2.6.1'
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml
@@ -71,6 +71,7 @@ on:
         default: ubuntu-latest
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -29,6 +29,7 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/deno-ci-reusable.yml b/.github/workflows/deno-ci-reusable.yml
@@ -42,6 +42,7 @@ on:
         default: v2.x
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/doc-format.yml b/.github/workflows/doc-format.yml
@@ -16,6 +16,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/dyadt-verify.yml b/.github/workflows/dyadt-verify.yml
@@ -16,6 +16,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml
@@ -38,6 +38,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml
@@ -104,6 +104,7 @@ on:
         default: "."
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
@@ -12,6 +12,7 @@ on:
         default: ubuntu-latest
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml
@@ -6,6 +6,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   # MUST be `write`, not `read`. hypatia-scan-reusable.yml declares
   # `security-events: write` so it can upload SARIF. A called workflow may
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
@@ -9,6 +9,7 @@ on:
     types: [published]
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/launcher-standard-lockstep.yml b/.github/workflows/launcher-standard-lockstep.yml
@@ -22,6 +22,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/makefile-blocker.yml b/.github/workflows/makefile-blocker.yml
@@ -22,6 +22,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/mirror-reusable.yml b/.github/workflows/mirror-reusable.yml
@@ -44,6 +44,7 @@ on:
         default: ubuntu-latest
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
@@ -7,6 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/no-js-scan.yml b/.github/workflows/no-js-scan.yml
@@ -31,6 +31,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
@@ -5,6 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
   pages: write
   id-token: write
diff --git a/.github/workflows/readme-derive-reusable.yml b/.github/workflows/readme-derive-reusable.yml
@@ -30,6 +30,7 @@ on:
         default: main
 
 permissions:
+  actions: read
   contents: read
 
 # Read-only check workflow — safe to cancel superseded runs.
diff --git a/.github/workflows/registry-verify.yml b/.github/workflows/registry-verify.yml
@@ -16,6 +16,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/rust-ci-reusable.yml b/.github/workflows/rust-ci-reusable.yml
@@ -102,6 +102,7 @@ on:
         default: "."
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
@@ -10,6 +10,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml
@@ -5,6 +5,7 @@ on:
   workflow_call:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml
@@ -74,6 +74,7 @@ on:
         default: ubuntu-latest
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
@@ -11,6 +11,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml
@@ -8,6 +8,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: write
 
 jobs:
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
@@ -55,6 +55,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
@@ -0,0 +1,60 @@
+# Governance
+
+## Overview
+
+This project is governed by the following principles and structures to ensure transparent, inclusive, and effective decision-making.
+
+## Roles and Responsibilities
+
+### Maintainers
+
+Maintainers are responsible for:
+- Reviewing and merging pull requests
+- Managing releases and versioning
+- Ensuring code quality and standards
+- Triaging issues and bug reports
+- Community engagement and support
+
+### Contributors
+
+Contributors are expected to:
+- Follow the code of conduct
+- Submit well-documented pull requests
+- Write tests for new functionality
+- Maintain existing tests
+- Update documentation as needed
+
+## Decision Making
+
+### Minor Changes
+- Can be made by any maintainer
+- Include bug fixes, documentation updates, dependency updates
+
+### Major Changes
+- Require discussion in issues or pull requests
+- Include new features, architectural changes, API changes
+- Need approval from at least 2 maintainers
+
+### Breaking Changes
+- Require RFC (Request for Comments) process
+- Need approval from majority of maintainers
+- Must include migration guide
+
+## Code of Conduct
+
+All participants are expected to follow our Code of Conduct. Violations can be reported to the maintainers.
+
+## Communication
+
+- **Issues**: For bug reports and feature requests
+- **Discussions**: For questions and general discussion
+- **Pull Requests**: For code contributions
+
+## Licensing
+
+All contributions are made under the terms of the repository's LICENSE file.
+By submitting a pull request, you agree to license your contributions accordingly.
+
+---
+
+*Last updated: 2026-07-18*
