chore: fill or remove RSR template placeholders

[hyperpolymath]

openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them, with no invention.

• Deleted the TEMPLATE INSTRUCTIONS (delete this block before publishing) comment — the template says to delete it, and it is where every legend line lived, so a large share of the reported tokens were the file documenting its own placeholders.
• Filled what the repository itself supplies: owner and repo from the git remote, project name, year, forge, main branch, contact email.
• Removed PGP and website lines. https://github.com/<user>.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasn't uploaded any GPG keys". No key is published for either account, and commit signing here is SSH — unrelated. The template sanctions this: "Optional: Remove sections that don't apply (e.g. PGP if you don't use it)."\n\nA security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption.\n\nWhere applicable, this also fixes a misrouted advisory URL. A previous just init copied already-filled templates out of squisher-corpus, so 51 repositories directed vulnerability reports to hyperpolymath/squisher-corpus — a repository unrelated to the code being reported, meaning the affected maintainer never saw them. Repointed from this repository's own git remote.

---

Summary by Gitar

• Guix package updates:
  • Updated guix.scm metadata referencing squisher-corpus and license PMPL-1.0-or-later
• Security & workflows:
  • Pinned CodeQL actions to SHA 29b1f65c and added actions: read permission across workflows
• Documentation cleanup:
  • Removed duplicate GOVERNANCE.adoc file, retaining GOVERNANCE.md

_{This will update automatically on new commits.}

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

CI failed: GitHub Actions workflow failed due to an unresolvable commit SHA for the CodeQL action introduced in this PR.

Overview

All analyzed CI logs failed due to a configuration error in the GitHub Actions workflow where an invalid or non-existent commit SHA was specified for a CodeQL action.

Failures

Unresolvable CodeQL Action SHA (confidence: high)

• Type: configuration
• Affected jobs: 90325954130, 90325954049
• Related to change: yes
• Root cause: The CodeQL workflow references a commit SHA that GitHub Actions cannot resolve or find.
• Suggested fix: Update the CodeQL action reference in .github/workflows/codeql.yml to use a valid tag or correct commit SHA.

Summary

• Change-related failures: 1 configuration failure caused by an invalid CodeQL action version SHA reference.
• Infrastructure/flaky failures: 0
• Recommended action: Fix the CodeQL action reference in .github/workflows/codeql.yml to use a valid SHA or release tag.

Code Review 👍 Approved with suggestions 2 resolved / 3 findings

Fills RSR template placeholders, updates Guix package metadata, and pins CodeQL actions, but the Guix package is mislabeled as squisher-corpus, its license conflicts with the SPDX header, and SECURITY.md still contains an unresolved PGP placeholder.

💡 Quality: SECURITY.md still contains unresolved PGP placeholder

📄 SECURITY.md:41-49

The PR summary states PGP lines were removed, but SECURITY.md still advertises Encrypted Email with Fingerprint | [PGP fingerprint not set], directing researchers to a nonexistent key. Since it uses square brackets rather than {{...}} it won't trip the openssf-compliance check, but it leaves a broken instruction. Remove the Encrypted Email/Fingerprint row as the summary intended.

✅ 2 resolved

✅ Bug: guix.scm mislabels cccp package as squisher-corpus

📄 guix.scm:2 📄 guix.scm:10 📄 guix.scm:14-16
This is the cccp repository (per the PR URL and SECURITY.md's hyperpolymath/cccp references), yet the commit "update guix.scm from squisher-corpus" renamed the package to squisher-corpus — name, synopsis, description, and home-page (https://github.com/hyperpolymath/squisher-corpus) now all point to an unrelated repo. This is the exact template-cross-contamination the PR claims to fix, applied in reverse. Restore the identity to cccp and home-page to https://github.com/hyperpolymath/cccp.

✅ Quality: guix.scm license conflicts with SPDX header

📄 guix.scm:1 📄 guix.scm:17
The license field was changed to PMPL-1.0-or-later while the SPDX-License-Identifier header on line 1 still reads MPL-2.0. These two license declarations now contradict each other, which will confuse tooling and downstream consumers. Align the SPDX header with the intended license (or revert the license field if MPL-2.0 is correct).

🤖 Prompt for agents

Code Review: Fills RSR template placeholders, updates Guix package metadata, and pins CodeQL actions, but the Guix package is mislabeled as squisher-corpus, its license conflicts with the SPDX header, and SECURITY.md still contains an unresolved PGP placeholder.

1. 💡 Quality: SECURITY.md still contains unresolved PGP placeholder
   Files: SECURITY.md:41-49

   The PR summary states PGP lines were removed, but SECURITY.md still advertises Encrypted Email with `Fingerprint | [PGP fingerprint not set]`, directing researchers to a nonexistent key. Since it uses square brackets rather than `{{...}}` it won't trip the openssf-compliance check, but it leaves a broken instruction. Remove the Encrypted Email/Fingerprint row as the summary intended.

Tip

Comment Gitar fix CI to trigger a fix.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}