[build](web): Actions(base workflows)

[RalphHightower]

Pull Request/Issue Number: N/A

---

🚨 Jekyll Pre‑Merge Verification

• Title correct
• Tags assigned
• Categories assigned
• Date correct (no accidental future dates)
• Front matter is valid YAML
• Liquid used only where required (stock‑quote posts)

---

Pull Request Type

Select one (one PR per change):

• New blog post(s)
• Bugfix(es)
• Code change(s)
• HTML / Jekyll / Liquid / Markdown change(s)
• Build error(s)
• Documentation
• Refactor (no functional changes)
• Security
• Templates
• Other (describe):

Reason for Change

---

Current Behavior

---

New Behavior

---

Files Added

Files Modified

Files Deleted

---

Environment

Languages

• APL
• awk
• C / C++ / C#
• Fortran
• HTML
• Java
• Javascript
• Jekyll
• Liquid
• Markdown
• Ruby
• SNOBOL
• YAML
• Other:

Operating Systems

• Android
• Linux
• Unix
• Solaris
• Windows

Hardware

Expand hardware list

• ARM
• DEC PDP‑8
• DEC PDP‑11
• DEC VAX
• DEC VAXStation
• IBM
• IBM System/360
• IBM System/370
• IBM System/370-XA
• IBM ESA/370
• IBM z/Architecture
• Intel 8080
• Intel Core
• Motorola 68000
• Raspberry Pi
• RISC‑V
• Sun SPARCStation

---

Other Information

---

Clean Exit

• Branch will be deleted after merge
• No overlapping PRs for this repo
• One change per branch

Build Status

• Success (assign 'action – success'). This may be delayed and updated in bulk.
• Partial Success (build succeeded, but not desired result. HTTP 404, etc.)
• Failure (Build failed. Mark status: "action – failed'. Copy build log in comment of this PR. Create Issue from Comment, click on '…', 'reference in new issue' with PR#{pull request number} as subject.
• Canceled (flag PR as 'action – canceled')

---

Branch Lifecycle

• This branch is single‑purpose
• No overlapping PRs for this repo

Scope of Change

• Number of files touched:
• Why these files belong together:

---

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/step-security/harden-runner	351661ca32ac09a36dc5ee2d536e3128f2a3c8ed	🟢 7.8	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 6 out of 6 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities ⚠️ 0 22 existing vulnerabilities detected
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 6.3	Details Check Score Reason Maintained 🟢 4 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Packaging ⚠️ -1 packaging workflow not detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/github/codeql-action/upload-sarif	2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2	Unknown	Unknown
actions/ossf/scorecard-action	2d1146689b8cda280b9bc96326124645441f03bc	🟢 8	Details Check Score Reason Code-Review 🟢 3 Found 3/9 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 7 3 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 20 out of 20 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 16 contributing companies or organizations
actions/step-security/harden-runner	351661ca32ac09a36dc5ee2d536e3128f2a3c8ed	🟢 7.8	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 6 out of 6 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities ⚠️ 0 22 existing vulnerabilities detected
actions/crs-k/stale-branches	138918e25f06d439bf76db5305a591d8a3c03678	🟢 4.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 0/1 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 4 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 10 SAST tool is run on all commits
actions/step-security/harden-runner	351661ca32ac09a36dc5ee2d536e3128f2a3c8ed	🟢 7.8	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 6 out of 6 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities ⚠️ 0 22 existing vulnerabilities detected

Scanned Files

• .github/workflows/newYearUpdateCopyright.yml
• .github/workflows/scorecard.yml
• .github/workflows/stale-branches.yml