ci: sha-pin actions, least-privilege tokens, add renovate (openssf scorecard)

[jensholdgaard]

What

Cheap-batch supply-chain hardening that lifts three OpenSSF Scorecard checks currently scoring 0 (aggregate 4.5). Pure CI/config — no crate code touched.

Check	Before	Change
Pinned-Dependencies	0 (tag pins)	all 15 distinct actions across 9 workflows pinned to 40-char commit SHAs, each with a # vX comment
Token-Permissions	0	top-level permissions: contents: read on ci.yml + commitlint.yml (the only two without one)
Dependency-Update-Tool	(robustify)	add .github/renovate.json

Notes

• dtolnay/rust-toolchain is pinned to a SHA and gains an explicit toolchain: stable input on all 8 blocks — SHA-pinning disables the action's ref-name channel detection, so the channel must be stated. The cargo-llvm-cov install likewise gains an explicit tool: input (the @cargo-llvm-cov magic tag is gone once SHA-pinned to v2).
• Renovate, not Dependabot (per maintainer call). config:best-practices enables helpers:pinGitHubActionDigests, so Renovate maintains these SHA pins and their version comments going forward rather than letting them rot. ⚠️ The config file satisfies Scorecard's check, but actual automation requires the Renovate GitHub App to be installed on the repo — maintainer action.
• Least-privilege is real least-privilege: coverage keeps its job-level contents: write (badge branch) and docs keeps contents: read; everything else drops to read.

Deferred (by design, premature pre-release)

Signed-Releases (cosign/SLSA provenance), Fuzzing (OSS-Fuzz), CII-Best-Practices registration — these belong at the first shipping milestone. Code-Review stays 0; it's an artifact of the admin-squash-merge workflow, not negligence.

Invariants

No §3 invariant or §4 hazard touched — CI/supply-chain config only. The gating test job and ci-success aggregate are unchanged.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added automated dependency update management via Renovate with weekly scheduling and dashboard support.
  • Pinned all GitHub Actions in CI/CD workflows to specific commit hashes to enhance security and ensure reproducible builds.

[coderabbitai]

Warning

Review limit reached

@jensholdgaard, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 51 minutes and 19 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 400c01fd-cc68-4d41-8fc1-61974d56116b

📥 Commits

Reviewing files that changed from the base of the PR and between c2c02d8 and 5a98d5f.

📒 Files selected for processing (1)

• .github/workflows/release.yml

📝 Walkthrough

Walkthrough

Adds a new .github/renovate.json Renovate configuration for automated dependency management. Across all existing GitHub Actions workflows (ci.yml, bench.yml, query-bench.yml, capture-otel-demo-corpus.yml, release.yml, scorecard.yml, pages.yml, pr-title.yml, commitlint.yml), every action reference is changed from a floating version tag to a pinned commit SHA.

Changes

Supply Chain Hardening

Layer / File(s)	Summary
Renovate bot configuration .github/renovate.json	New file establishing best-practice presets, semantic commit conventions, dependency dashboard, a prConcurrentLimit of 5, a weekly Monday schedule, and packageRules for digest-pinning github-actions and grouping cargo minor/patch updates.
Pin actions to commit SHAs across all workflows .github/workflows/ci.yml, .github/workflows/bench.yml, .github/workflows/query-bench.yml, .github/workflows/capture-otel-demo-corpus.yml, .github/workflows/release.yml, .github/workflows/scorecard.yml, .github/workflows/pages.yml, .github/workflows/pr-title.yml, .github/workflows/commitlint.yml	Every uses: reference across all workflows is replaced with a pinned commit SHA. ci.yml additionally gains workflow-level permissions: contents: read and explicitly sets toolchain: stable inputs on the dtolnay/rust-toolchain steps.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hop, hop, no more floating tags to trust,
Each SHA locked down — supply chain's a must!
Renovate wakes Monday before the sun,
Groups cargo patches when the week's begun.
No drifting versions shall sneak in unseen —
The burrow is hardened, tidy, and clean! 🔒

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description comprehensively covers the what, why, and how, with detailed context on implementation specifics, deferred items, and invariants. However, it does not follow the repository's required template structure (Summary/Related/Checklist sections).	Restructure the description to follow the template with Summary, Related, and Checklist sections while preserving the detailed technical content.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and specifically summarizes the main changes: SHA-pinning GitHub Actions, implementing least-privilege token permissions, adding Renovate configuration, and the OpenSSF Scorecard compliance motivation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/scorecard-cheap-batch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR hardens the repository’s CI supply chain and permissions to improve OpenSSF Scorecard results, without changing any Rust/crate code.

Changes:

• Pin GitHub Actions across workflows to full 40‑char commit SHAs (with version comments).
• Add least-privilege default permissions where missing (notably ci.yml and commitlint.yml), keeping job-level escalation where required.
• Introduce Renovate configuration (.github/renovate.json) to support automated dependency updates and action digest pin maintenance.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/scorecard.yml	SHA-pin Scorecard-related actions used for SARIF publishing and analysis.
.github/workflows/release.yml	SHA-pin release workflow actions used for changelog + GitHub Release creation.
.github/workflows/query-bench.yml	SHA-pin actions and explicitly set toolchain input for the pinned rust-toolchain action.
.github/workflows/pr-title.yml	SHA-pin PR title lint action.
.github/workflows/pages.yml	SHA-pin Pages build/deploy actions.
.github/workflows/commitlint.yml	Add explicit least-privilege permissions and SHA-pin checkout + commitlint actions.
.github/workflows/ci.yml	Add workflow-level least-privilege permissions; SHA-pin actions; add explicit toolchain / tool inputs where needed.
.github/workflows/capture-otel-demo-corpus.yml	SHA-pin checkout and upload-artifact actions.
.github/workflows/bench.yml	SHA-pin actions and explicitly set toolchain input for the pinned rust-toolchain action.
.github/renovate.json	Add Renovate config enabling dependency update automation and grouping/pinning behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 13-15: The actions/checkout action in the release workflow is
keeping credentials persisted in .git/config by default, which increases
security risk. Add persist-credentials: false to the with section of the
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 step to disable
credential persistence, since the release job does not need to push commits and
this reduces token exposure to subsequent steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 68ed514a-5a6f-43de-a84b-7d5e1b2f2f1a

📥 Commits

Reviewing files that changed from the base of the PR and between 9fd7521 and c2c02d8.

📒 Files selected for processing (10)

• .github/renovate.json
• .github/workflows/bench.yml
• .github/workflows/capture-otel-demo-corpus.yml
• .github/workflows/ci.yml
• .github/workflows/commitlint.yml
• .github/workflows/pages.yml
• .github/workflows/pr-title.yml
• .github/workflows/query-bench.yml
• .github/workflows/release.yml
• .github/workflows/scorecard.yml

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.