Pin reusable workflows to published standards 0.1.2. Require tagged commits
on main, rerun the main quality and security gates before release, and fail
preflight when NuGet publishing configuration is missing.
Add pinned pre-commit hooks, JavaScript lint and dependency verification,
PowerShell analysis and coverage-gate regression tests, and a trusted
current-commit review-record check. Document the single-maintainer limitations
and the unfinished OpenSSF assessment without claiming certification.
Validation: seven Node and four Pester tests passed, lint and workflow checks
passed, and 83 npm registry signatures plus 20 attestations verified. Full
AppKit build, unit coverage and UI gates passed. Live check enforcement and
owner attestations remain tracked follow-up work.
Refs: #4, #6, #7, #8, #13, #15, #18
Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
james.maesandCodex
36886cbaae