feat(scorecard): close remaining code-actionable findings — Signed-Releases + Pinned-Deps Meteor + license badge#270

Merged

Cre-eD merged 11 commits into

mainfrom

feat/github-releases-with-sigstore

May 18, 2026

Commits on May 18, 2026

feat(release): create signed GitHub Release on prod tags (Signed-Releases -1 → climbing)
Cre-eD
committed
docs(pinned-deps): inline Meteor Dockerfile into README, delete standalone (Scorecard Pinned-Deps 9→10)
Cre-eD
committed
docs(readme): fix license badge (MIT, not Apache) + add OpenSSF Baseline + fix CONTRIBUTING link
Cre-eD
committed
docs(security): add direct maintainer email as a fallback contact
Cre-eD
committed
docs: add CONTRIBUTING.md (README referenced a file that did not exist)
Cre-eD
committed
docs: add DEPENDENCIES.md describing selection / obtain / track (OSPS-DO-06.01)
Cre-eD
committed
docs: add MAINTAINERS.md with access map + roles (OSPS-GV-01.01 + 01.02)
Cre-eD
committed
ci(dco): enforce Signed-off-by trailer on every PR commit (OSPS-LE-01.01)
Cre-eD
committed
docs: add ARCHITECTURE.md with actors, actions, trust boundaries
Cre-eD
committed
docs(security): document public disclosure cadence (OSPS-VM-04.01)
Cre-eD
committed
docs(maintainers): refactor list to reflect real git-history contributors
Cre-eD
committed