fix(security): pin Legitify to post-v1.0.11 main SHA, distribute badge (v0.19.3)

[nullvariant]

Summary

• Fix Legitify workflow failing after merge of feat(security): add Legitify SCM posture audit #472 — Legit-Labs/legitify@v1.0.11 is incompatible with the current GitHub Actions runtime (deprecated upload-artifact@v3 inside its composite action)
• Pin to post-v1.0.11 main SHA (038aa49) where the upstream fix has already landed
• Distribute the Legitify static badge across the root README, the extension README, and all 26 localized READMEs — the badge is intentionally visible at every entry point
• Bump git-id-switcher to 0.19.3 and update CHANGELOG so the README surface changes ship to the Marketplace

Root cause

Legit-Labs/legitify@v1.0.11 (2024-07-09) pulls github/codeql-action/upload-sarif@v3 which internally depends on actions/upload-artifact@v3. GitHub started auto-failing workflows using that dependency on 2024-04-16. The upstream fix (node 20, newer codeql-action) landed on main via PR #333 on 2024-09-11, but no new release tag has been published since v1.0.11.

What changed

• .github/workflows/security.yml: bump uses from @002049404ef9… (v1.0.11) to @038aa49473a6… (post-v1.0.11 main, 2024-09-25) with an inline comment explaining the rationale and linking the follow-up tracking
• README.md (root): add static Legitify — SCM Posture Audit badge next to Harden-Runner
• extensions/git-id-switcher/README.md + 26 localized READMEs: same static badge added to the existing badge row
• extensions/git-id-switcher/package.json: 0.19.2 → 0.19.3
• extensions/git-id-switcher/CHANGELOG.md: Added (badge distribution) and Fixed (Legitify pin) entries for 0.19.3

Why a static badge (not a workflow status badge)

GitHub Actions status badges are per-workflow, not per-job. Since Legitify runs as one job inside security.yml, a dynamic badge would reflect the status of every security job, not Legitify specifically. Splitting security.yml just to get a per-job badge was rejected in #472 review for SSOT reasons. A static badge next to the existing "monitored" collection (Snyk / Socket / GitGuardian / Harden-Runner) fits the established aesthetic.

Follow-up tracking

The upstream pattern (fix on main, no release tag) is already tracked. The follow-up item will be updated to reflect that this PR now pins to main HEAD and must be audited manually in sync with the 90-day PAT rotation.

Test plan

• Merge triggers the auto-tag workflow → git-id-switcher-v0.19.3 tag is pushed
• publish.yml succeeds and ships 0.19.3 to VS Code Marketplace and Open VSX
• security.yml Legitify job turns green on the next scheduled run (or manual workflow_dispatch)
• Legitify findings appear in the GitHub Security → Code Scanning tab

[nullvariant-mimi]

🐰 Mimi's Validation Report ✅

All checks are looking good! Great job! 🎉

⏳ Some checks are still running. I will keep watching!

---

バリデーターを通してくださいね

This report was carefully prepared by nullvariant-mimi[bot]

[nullvariant-blaze]

🐗 Blaze's Release Review 🔥

🔥🔥🔥 VERSION BUMP DETECTED! THIS IS IT! 🔥🔥🔥

✨ PATCH VERSION BUMP in extensions/git-id-switcher/package.json

0.19.2 → 0.19.3

✨ Quick patch! Nice and clean.

---

よっしゃ！デプロイしまくるぞ！

This review was ENTHUSIASTICALLY filed by nullvariant-blaze[bot]

[nullvariant-luna]

👧 Luna's Exploration Report 📦

No new dependencies added. Just version bumps! Nothing to explore here... 😴

---

Botに418返そうよ！

This report was curiously compiled by nullvariant-luna[bot]

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/Legit-Labs/legitify	038aa49473a6974a3ef79f6c76b949b689d23282	🟢 4.2	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ 2 1 out of the last 5 releases have a total of 1 signed artifacts. SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• .github/workflows/security.yml

[nullvariant-slow]

🦥 Slow's Code Review 😩

...yawn... Do I really have to review this?

⚠️ TOO LONG... I can barely keep my eyes open reading these:

File	Lines

| extensions/git-id-switcher/src/ui/documentationInternal.ts | 505 |

Split it up... reading long files is exhausting.

---

働きたくないでござる

This review was reluctantly filed by nullvariant-slow[bot]

[nullvariant-ciel]

🕊️ Ciel's Mediation ☀️

*~~ gliding on a gentle breeze ~~ How serene!*

4 zoo members have reviewed this PR.

Zoo Member	Status
🦥 Slow	Commented
🐰 Mimi	Commented
👧 Luna	Commented
🐗 Blaze	Commented

☀️ The zoo is in harmony. Everything looks peaceful from up here.

---

まあまあ、ほどほどに。

This mediation was peacefully delivered by nullvariant-ciel[bot]

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[nullvariant-justice]

⚖️ Justice grants passage. CI checks passed — this code meets the garden's standards.