feat(RAN-54): land OpenSSF Best Practices passing + Scorecard hardening

[aksOps]

Summary

Replicates the codeiq RAN-46 (B) OSS-CLI security recipe on snipIT, adapted for a single-file PowerShell 7.5+ project on .NET 9. Closes RAN-54.

PowerShell-specific delta (carried into shared/runbooks/engineering-standards.md so future PowerShell repos inherit it):

• PSScriptAnalyzer is the language-lint slot in security.yml — codeiq's SpotBugs equivalent.
• OSV-Scanner is intentionally omitted — snipIT has zero external runtime deps (no npm / Maven / pip lockfile to scan). Trivy filesystem scan is the SCA channel; Dependabot covers the GitHub Actions ecosystem.
• Semgrep runs p/security-audit + p/owasp-top-ten (no p/powershell pack ships in Semgrep registry today).
• jscpd format set to powershell, --min-tokens 100, scoped to SnipIT.ps1.

Files

New

• .github/workflows/scorecard.yml — ossf/scorecard-action@v2.4.3, push-to-main + Mondays 06:00 UTC, SARIF → Security tab. Hardened runner, all actions SHA-pinned.
• .github/workflows/security.yml — Trivy + Semgrep + PSScriptAnalyzer + Gitleaks + jscpd + SBOM. Top-level permissions: read-all; jobs scope up only when needed.
• .github/dependabot.yml — github-actions ecosystem only (sole versioned dep surface), weekly + grouped.
• SECURITY.md — private-disclosure policy, supported versions, scope, hardening references.
• .bestpractices.json — OpenSSF Best Practices self-assessment for project_id 12647.
• CLAUDE.md — agent brief: layout / build / test / run / conventions / OpenSSF Scorecard baseline + target / gotchas.
• shared/runbooks/engineering-standards.md — PowerShell variant of the company canonical runbook.
• scripts/setup-git-signed.sh — one-shot signed-commit setup (ssh / openpgp / x509).

Modified

• .github/workflows/test.yml — pin actions/checkout by SHA, add top-level permissions: read-all, drop the PSScriptAnalyzer job (moved to security.yml per AC).
• README.md — OpenSSF Best Practices + Scorecard + Security workflow badges added at top.

Acceptance criteria status

• PowerShell-specific linting added to security.yml: PSScriptAnalyzer in addition to the (B) OSS-CLI stack.
• shared/runbooks/engineering-standards.md updated to document the PowerShell variant (PSScriptAnalyzer addition). The company canonical runbook also gets the per-language linter row updated so future PowerShell repos inherit the convention.
• .github/workflows/scorecard.yml lands (ossf/scorecard-action, push to main + weekly cron, SARIF → Security tab) with actions pinned by SHA.
• .github/workflows/security.yml mirroring codeiq's (B) OSS-CLI stack (Semgrep, Trivy, Gitleaks, jscpd, anchore/sbom-action), language-adapted (PSScriptAnalyzer added; OSV-Scanner omitted — no lockfiles to scan).
• SECURITY.md at repo root.
• OpenSSF Best Practices badge at top of README.md.
• .bestpractices.json at repo root (project_id 12647, target = passing).
• OpenSSF Scorecard baseline + target documented in repo CLAUDE.md (baseline pending — first scoreboard score after this PR merges; will be filled in the next PR per the table).

Out-of-band actions (handled in the next heartbeat after merge)

• PATCH Paperclip Project snipIT codebase.repoUrl to https://github.com/RandomCodeSpace/snipIT.git.
• Enable signed-commits branch protection on main with the new required-status-check set.
• Enable repo-level Dependabot security updates.
• Mark Best Practices criteria Met on https://www.bestpractices.dev/en/projects/12647 — board admin OAuth required (.bestpractices.json already reflects passing-level answers).

Out of scope (explicit per AC)

• Functional / feature work on snipIT.
• Migrating off the (B) OSS-CLI stack.
• Self-hosted infra (no SonarQube self-host, no GHAS-paid CodeQL).

Test plan

• pwsh -NoProfile -File ./Test-SnipIT.ps1 — 84/84 pass
• Invoke-ScriptAnalyzer -Path ./SnipIT.ps1 -Severity Error — 0 errors (49 warnings, non-blocking)
• python3 -c 'import yaml; yaml.safe_load(...)' on every workflow + dependabot — clean
• python3 -c 'import json; json.load(...)' on .bestpractices.json — clean
• bash -n scripts/setup-git-signed.sh — clean
• CI: test.yml (Linux + Windows headless tests + Windows AST parse) green
• CI: security.yml (six jobs) green
• CI: scorecard.yml runs on first push to main and posts SARIF
• First Scorecard score recorded into CLAUDE.md table in a follow-up PR

Follow-ups (not blocking this PR)

• README test-count badge says tests-82/82 but the suite now has 84 tests — file a chore to update the badge in step with the suite.
• After branch protection lands, configure required status checks: Pure-logic tests (pwsh 7.5+), Parse SnipIT.ps1 on Windows (no execution), Trivy (filesystem + container scan), Semgrep (SAST), PSScriptAnalyzer (Error severity gate), Gitleaks (secret scan), jscpd (duplication < 3% on touched code), SBOM (SPDX + CycloneDX).

🤖 Generated with Claude Code