security: bootstrap sscsb supply-chain controls, and retire a scanner that scanned nothing

[p4gs]

Summary

Bootstraps sscs-bootstrapper on ALCOVE: 47 controls installed, 32 enabled. sscsb verify goes 4 failed / 3 degraded → 1 failed / 2 degraded.

Four things needed deciding rather than accepting as generated.

TruffleHog is the only credential-detection engine. gitleaks = false in .sscsb/config.toml, and the generated gitleaks CI job is removed so CI enforces the policy the config declares instead of contradicting it. TruffleHog verifies candidates against the issuing provider, so a finding is a live credential rather than a high-entropy string.

CodeQL now reads this repo's actual source. The generated matrix is ["actions"] — the only language sscsb can assume every repo has — and its own comment warns that CodeQL which does not read your source code is not analysing your source code. Added javascript-typescript for assets/js/site.js, the one executable file ALCOVE ships.

Removed .github/workflows/semgrep.yml, which had been green daily while analysing nothing. It passes SEMGREP_APP_TOKEN from a secret that does not exist on this repository (gh secret list is empty), so every run since 2026-08-23 logged:

run `semgrep login` before using `semgrep ci` or use `semgrep scan` and set `--config`
There were errors during analysis but Semgrep will succeed because there were no blocking findings

…and exited 0. Roughly twenty consecutive green runs, zero analysis. It was also the sole source of three sscsb verify failures (actions/checkout@v4 on a mutable ref, no persist-credentials: false, no harden-runner). Its replacement already runs here: OpenGrep (Semgrep-compatible, committed ruleset, no cloud token) plus CodeQL. Pinning it would have left a workflow that still scanned nothing — a green check that cannot fail is worse than no check, because people trust it.

Added SECURITY.md, which security-insights.yml referenced twice without it existing, and filled the generated REPLACE-ME placeholders.

Why this is a PR and not a push to main

The pre-push gate requires hardware_backed = true on protected branches. The approved signer is the 1Password-vaulted ed25519 key that already signs every commit in this repo — a vaulted software key, not a non-exportable secure element — so signers.toml records it as backend = "software" with no hardware assertion. Both commits here are signed and verify Good.

Relaxing that gate was deliberately not done. The honest options were a false hardware_backed = true attestation, --no-verify, or a documented require_hardware_backed = false — and the third was blocked by the agent permission classifier, correctly, as a weakening of a security control. It is left for a human decision. See "Open items".

Open items for the maintainer

1. Branch protection — the one remaining verify failure. main has no ruleset: no required PRs, no force-push blocking, no required signed commits, no required status checks. sscsb harden branch-protection can only update an existing ruleset, not create one, and creating it is a repo-admin write. Needs a human.
2. Signing posture. Either accept software-backed signing for this repo (set require_hardware_backed = false, documenting why), or provision a YubiKey ed25519-sk and record it with hardware_backed = true. Until one of those, direct pushes to main are blocked locally by design.
3. signing-model degraded — the github-web, codespaces and cloud-claude lanes are attestations only a human can truthfully make (sscsb signing setup <lane> --confirm). Not fabricated here.
4. scorecard degraded — no published results yet. Resolves once scorecard.yml runs on the default branch, i.e. after this merges.

AI Provenance Declaration

• AI generated or assisted with code in this PR
• AI generated or assisted with tests in this PR
• AI introduced or suggested new dependencies in this PR
• AI generated or assisted with documentation in this PR

AI tool(s)/model(s) used (if any): Claude Code (claude-opus-5), AI-Role: draft

Human review performed on AI-generated parts (what/how): Pending maintainer review. Every claim above is tool-verified rather than asserted: the Semgrep no-op is quoted from run 34686171235's own log, the empty secret list from gh secret list, and the verify counts from sscsb verify before and after.

Dependency Changes

• No new dependencies

🤖 Generated with Claude Code

https://claude.ai/code/session_017N6Qc2T7buVAXHZ9vYa1xm

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.