OpenSSF Scorecard OSSFSC-3: Build, CI/CD Security, Workflow Permissions, Dangerous Patterns

Operate build + CI/CD security per OpenSSF Scorecard checks Token-Permissions + Dangerous-Workflow + CI-Tests + CII-Best-Practices. Token Permissions in Workflows must (a) restrict GITHUB_TOKEN to minimum permissions per workflow + (b) avoid blanket write-all + (c) verify scope of permissions per job + step. Dangerous Workflow Patterns Absent must avoid (a) untrusted code checkout via pull_request_target with checkout of PR head + (b) script injection via expressions referencing untrusted input + (c) other dangerous patterns documented by Scorecard. Continuous Integration Tests must (a) verify tests run on every PR + (b) tests cover meaningful functionality + (c) tests provide signal for merge gating. Build provenance must (a) generate SLSA provenance for releases per applicable SLSA level + (b) sign provenance + verify at consumption. Packaging via Trusted Publishers must (a) use OIDC-based publishing (PyPI Trusted Publishers + npm + similar) + (b) avoid long-lived publishing credentials + (c) verify publisher identity at consumer side.