ci: add review-gate, OpenSSF Scorecard and Dependabot cooldown
RI
8h ago+139+139+012345678901234567890123456789-0-0-0123456789
Changes:
- review-gate.yml (waits for the CodeRabbit and cubic check runs on the head commit; fails if cubic did not complete or CodeRabbit was off or errored; warns when CodeRabbit is rate limited or skips a later push after a finished review) and scorecard.yml (OpenSSF Scorecard, weekly, SARIF upload); permissions are least-privilege and every action is pinned to a full commit SHA, same files as machine-made/pi-effort
- cooldown default-days 7 on each Dependabot update entry (uv's exclude-newer fails Dependabot jobs on releases younger than 7 days)
Summary by CodeRabbit
- Chores
- Automated dependency updates now wait seven days before opening update requests.
- Pull requests are checked for completed automated reviews, with incomplete or unsuccessful reviews causing the check to fail.
- A scheduled and on-demand security scorecard check now reports findings to code scanning.