Description

This PR fixes the broken OpenSSF Scorecard badge by removing a run: step from the scorecard workflow that violated ossf/scorecard-action restrictions. Additionally, it addresses workflow security configurations by adding explicit permission blocks and pinning npm dependencies to specific versions.

• Removed job summary step from scorecard.yml that used run: commands, which caused workflow verification failures and prevented the Scorecard API from accepting results
• Added explicit permissions: contents: read block to pester-tests.yml to satisfy scorecard token permissions requirements
• Removed redundant security-events: write from security-scan.yml top-level permissions (already declared at job level)
• Pinned @vscode/vsce@3.7.1 in extension-publish-prerelease.yml (two locations) to address npm dependency pinning requirements

Related Issue(s)

Closes #300
Closes #292
Closes #291

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Testing

• Ran npm run lint:yaml to validate all 21 workflow files pass YAML/actionlint checks
• Verified workflow syntax is valid for all modified files

Checklist

Required Checks

• Documentation is updated (if applicable)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable)

AI Artifact Contributions

N/A - No AI artifacts in this PR.

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues
• Security-related scripts follow the principle of least privilege

Additional Notes

The root cause of the broken scorecard badge was the run: step in scorecard.yml. The ossf/scorecard-action explicitly restricts workflows containing arbitrary shell commands to prevent supply chain attacks, which caused all workflow runs to fail verification and return empty results to the Scorecard API.

🔧 Generated by Copilot