ci: add review-gate, OpenSSF Scorecard and Dependabot cooldown
RI
6h ago+139+139+012345678901234567890123456789-0-0-0123456789
Changes:
- review-gate.yml (waits for the CodeRabbit and cubic check runs on the head commit; fails if cubic did not complete or CodeRabbit was off or errored; warns when CodeRabbit is rate limited or skips a later push after a finished review) and scorecard.yml (OpenSSF Scorecard, weekly, SARIF upload); permissions are least-privilege and every action is pinned to a full commit SHA, same files as machine-made/pi-effort
- cooldown default-days 7 on each Dependabot update entry (uv's exclude-newer fails Dependabot jobs on releases younger than 7 days)
Summary by CodeRabbit
- Chores
- Automated dependency updates now observe a seven-day cooldown before being proposed.
- Pull requests receive additional automated review checks, and security analysis runs on a regular schedule and relevant repository changes. These checks can affect whether a pull request passes validation.