chore(repo): add community health files, security policy and code scanning

[mariano-aguero]

What this changes

Adds the community and security files the repository was missing: issue forms, a pull request template, SECURITY.md, CODE_OF_CONDUCT.md, CODEOWNERS, Dependabot, CodeQL and OpenSSF Scorecard. No source or test files are touched.

The issue forms are shaped around what this project actually needs to hear. The first template is a divergence report, which asks for the transaction hash or byte vector, the ethrex commit or endpoint, and the rule set the reporter priced under, because a disagreement with the reference client is a result rather than a nuisance and is unusable without those three. The bug form asks for the viem version separately, since a duplicated peer copy is the common cause of type errors around client.extend. Blank issues are off and the config links point at the ethrex tracker for node bugs and at a private advisory for anything in the signing or hashing path.

Why

Someone arriving at this repository had no way to tell which reports are wanted, where a vulnerability goes, or what a pull request is expected to argue. The invariants were already written down in CONTRIBUTING.md, but nothing put them in front of a contributor at the moment they open a pull request. The template now asks which of the three oracles pins the change, and whether it touched anything under "Rules that are not style preferences".

SECURITY.md states a scope rather than a disclaimer. hegota-testnet assets are not real, so the risk worth reporting is that this library produces bytes a signer is asked to authorise, and that consumers will carry the same code onto a chain where the assets are real. In scope: the v || r || s layout and recovery id encoding, a re-encoding that does not reproduce its hash, assertValidFrameTx accepting an envelope consensus rejects, and gas accounting that understates maxCost. Out of scope and stated as such: node bugs, the public endpoint, and encodeFrameTx not validating, which is by design.

Dependabot carries cooldown: default-days: 7 to match minimumReleaseAge in bunfig.toml. Without it every proposed bump would be a version a local bun install refuses to resolve.

How the new behaviour is pinned

• A published figure, transcribed rather than derived
• The golden byte vector or sig-hash from ethrex's frame_tx_wire_tests.rs
• Re-encoding captured chain data and reproducing the transaction hash
• A live receipt (recovered signer, maxCost, or the gasUsed decomposition)
• N/A, this change has no wire-format or gas behaviour

The workflows and the YAML forms were validated with actionlint and a YAML parse, which is the only verification this change admits.

Load-bearing rules

• No
• Yes, and the argument for it is below

CONTRIBUTING.md gains pointers to the new files and a note on what the pull request and divergence templates ask for. No existing prose was rewritten.

Checks

• bun run test
• bun run typecheck
• bun run build && bunx @arethetypeswrong/cli --pack . (required if exports, files, typesVersions or tsup.config.ts changed; otherwise N/A)
• bun run test:live (optional, hits the public endpoint, not a gate)

293 tests pass and the type check is clean. The packaging check is N/A: nothing in the published tarball or the exports map changes.

Release impact

• No release (docs, chore, test, ci, refactor, style, perf, build)
• Patch (fix)
• Minor (feat)
• Major (feat! or a BREAKING CHANGE: footer)

AI assistance

• This change was written or reviewed with an assistant, and I have read every line of it

Two things that need repository settings, not code

Private vulnerability reporting is disabled, so the advisory link in SECURITY.md does not yet work for anyone outside the organisation. It needs enabling under Settings, Security. An API call to enable it returned 404 for lack of admin rights.

CODEOWNERS is ignored in silence for any account without write access, so both handles listed there should be confirmed before merging.

Related issues

Four issues were opened from docs/OPEN-ITEMS.md to give the new good first issue label something to point at: #10, #11, #12 and #13.

[justalab-agents]

Findings outside the diff

These sit on lines this PR did not change, but this PR is what makes them wrong. They cannot be posted as inline comments.

• [WARNING] .github:2 — Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: amannn/action-semantic-pull-request@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Reviewer callouts (3)

Non-blocking observations. Nothing here needs to change before merge.

• .github/workflows/codeql.yml:23 — Pin to a full commit SHA for reproducible builds (e.g. actions/checkout@ # v7).
• .github/workflows/scorecard.yml:22 — Pin to a full commit SHA for reproducible builds (e.g. actions/checkout@ # v7).
• .github/workflows/scorecard.yml:32 — Pin to a full commit SHA for reproducible builds (e.g. actions/upload-artifact@ # v7).

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[mariano-aguero]

Review round handled, two commits.

3440690 pins every action in the two new workflows to a full commit SHA with a trailing version comment: github/codeql-action at b96794f (v4.38.0), ossf/scorecard-action at 2d11466 (v2.4.4), actions/checkout at 3d3c42e (v7.0.1) and actions/upload-artifact at 043fb46 (v7.0.1). That covers the four inline warnings and the three non-blocking callouts, and it matters more than usual here because this PR adds the Scorecard workflow, whose own Pinned-Dependencies check reads these files.

4861ca4 takes pr-title.yml off the deprecated Node 20 runtime by moving amannn/action-semantic-pull-request from v5 to v6.1.1, also SHA-pinned. The only breaking change in that major is the Node 24 and ESM upgrade, so the types, scopes and subjectPattern inputs are untouched. This PR's own title check exercises it.

The email address in CODE_OF_CONDUCT.md stays. Reasoning is on that thread.

Left for a separate change: ci.yml and release.yml still use floating major tags, several of them a major behind. Pinning them means either freezing them at their current SHAs or bumping first, and one of them is the publish path, so it should not ride along here. Dependabot will start proposing those bumps once this merges.

Unrelated to this PR, but it surfaced while pushing it: the default branch has two open Dependabot alerts, both against vitest as a development dependency. The critical one requires the Vitest UI server to be listening, which this repository never starts, and neither is reachable from the published package, since the tarball ships dist only. The fix is a major bump from 2.x, so it wants its own change and its own test run.

[github-actions]

🎉 This PR is included in version 0.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀