feat(security): add Legitify SCM posture audit

[nullvariant]

Summary

• Add Legitify SCM posture audit as a new job in security.yml — weekly repository-configuration audit running on the existing daily schedule (skipped on PRs)
• Pin to Legit-Labs/legitify@002049404ef93b207048323fe996eb2330327031 (v1.0.11)
• Publish findings to the GitHub Security tab via SARIF upload
• Scope limited to this repository (analyze_self_only: true) with a read-only fine-grained PAT

What changed

• .github/workflows/security.yml: new legitify-analyze job. No checkout step — Legitify queries the GitHub API directly; the composite action only checks out its own source when compile_legitify=true (not used here)
• SECURITY.md: document under CI/CD Security; register SCM_TOKEN in Repository Secrets, Provider Links, and Token Details
• GOVERNANCE.md: add SCM Posture Audit as a sekimori-ishi immediately after Branch Protection

Rationale

The existing badge collection covers code/dependency-level posture (CodeQL, Semgrep, Scorecard, Snyk, FOSSA). Legitify covers repository-configuration-level posture — branch protection settings, actions settings, webhook hygiene — which is otherwise unaudited. Keeping this in security.yml (rather than a standalone workflow) preserves a single source of truth for security checks.

Pre-merge owner actions

• Create SCM_TOKEN (Fine-grained PAT): scope this repository only; permissions: Metadata (R), Contents (R), Administration (R); expires 2026-07-15
• Register SCM_TOKEN in repository secrets

Test plan

• After merge, trigger workflow_dispatch manually and verify the job succeeds
• Check Actions logs for missing permission warnings from Legitify
• Verify findings appear in GitHub Security → Code Scanning Alerts
• Observe 2–3 runs to assess whether the badge stays green even when posture violations are detected

Security considerations

• Top-level permissions: {} preserved; job-level permissions limited to contents: read + security-events: write
• SCM_TOKEN is skipped on pull requests (if: github.event_name != 'pull_request') to prevent exposure in untrusted PR contexts
• Harden-Runner egress-policy: audit matches existing security.yml jobs; migration to block is tracked as a follow-up

[nullvariant-slow]

🦥 Slow's Code Review 😩

...yawn... Do I really have to review this?

⚠️ TOO LONG... I can barely keep my eyes open reading these:

File	Lines

| extensions/git-id-switcher/src/ui/documentationInternal.ts | 505 |

Split it up... reading long files is exhausting.

---

働きたくないでござる

This review was reluctantly filed by nullvariant-slow[bot]

[nullvariant-mimi]

🐰 Mimi's Validation Report ✅

All checks are looking good! Great job! 🎉

⏳ Some checks are still running. I will keep watching!

---

バリデーターを通してくださいね

This report was carefully prepared by nullvariant-mimi[bot]

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/Legit-Labs/legitify	002049404ef93b207048323fe996eb2330327031	🟢 4.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ 2 1 out of the last 5 releases have a total of 1 signed artifacts. SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/security.yml

[nullvariant-ciel]

🕊️ Ciel's Mediation ☀️

*~~ gliding on a gentle breeze ~~ How serene!*

2 zoo members have reviewed this PR.

Zoo Member	Status
🦥 Slow	Commented
🐰 Mimi	Commented

☀️ The zoo is in harmony. Everything looks peaceful from up here.

---

まあまあ、ほどほどに。

This mediation was peacefully delivered by nullvariant-ciel[bot]

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[nullvariant-justice]

⚖️ Justice grants passage. CI checks passed — this code meets the garden's standards.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[nullvariant-justice]

⚖️ Justice grants passage. CI checks passed — this code meets the garden's standards.