ci: add review-gate, OpenSSF Scorecard and Dependabot cooldown
RI
5h ago+135+135+012345678901234567890123456789-0-0-0123456789
Changes:
- review-gate.yml (waits for the CodeRabbit and cubic check runs on the head commit; fails if cubic did not complete or CodeRabbit was off or errored; warns when CodeRabbit is rate limited or skips a later push after a finished review) and scorecard.yml (OpenSSF Scorecard, weekly, SARIF upload); permissions are least-privilege and every action is pinned to a full commit SHA, same files as machine-made/pi-effort
Summary by CodeRabbit
- Chores
- Pull requests now receive automated checks for review completion, with unsuccessful or missing review results flagged before the checks pass.
- A security scorecard now runs on a schedule and after selected repository events. Its results are made available through code scanning.
- Draft and automated dependency-update pull requests are excluded from the review checks; manual scorecard runs are limited to the default branch.