security: track and reconcile remaining OpenSSF Scorecard findings

[jason-allen-oneal]

Objective

Track the remaining non-vulnerability OpenSSF Scorecard posture findings.

Pinned snapshot: 9afd71e701fbd3e04f05b715f63a4d36b1c1b45c
Review date: 2026-10-26
Scorecard run: https://github.com/BlueDot-IT/SignalGate/actions/runs/33341359414

Current controls

main has strict checks, admin enforcement, one required approval, stale-review dismissal, conversation resolution, force-push/deletion prevention, and required CI, ClusterFuzzLite, and CodeQL checks.

Findings

• Alert chore(deps): bump pygments from 2.19.2 to 2.20.0 #12 Maintained — verify automatic closure after the 90-day threshold at 2026-10-24T23:40:25Z.
• Alert chore(deps): bump pytest from 9.0.2 to 9.0.3 #11 CodeReview — current instance is historical 2/25; preserve mandatory exact-head reviews and recheck the trend.
• Alert chore(deps): bump the github-actions group across 1 directory with 8 updates #13 CII Best Practices — assign an owner and complete or explicitly defer badge enrollment.

Alert #14 Vulnerabilities is excluded from governance acceptance. Its time-bounded risk is tracked in #15 and implemented by #16. Reassess no later than 2026-10-31.