chore: add the OpenSSF Scorecard workflow

[Fieldnote-Echo]

Adds the same Scorecard caller that cd-formalization and fd-formalization use (identical file), pinned to e4ab481, the current .github main. It runs on pushes to main, Mondays at 06:15 UTC, and on demand.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-30T22:03:27.905814Z	7becb48	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "Codex (@codex) review" or "Codex (@codex) security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each severity your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

PR Summary by Qodo

chore: add OpenSSF Scorecard workflow

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Adds a reusable OpenSSF Scorecard GitHub Actions workflow, mirroring cd/fd-formalization repos.
• Pins the reusable workflow call to commit e4ab481 of Project-Navi/.github.
• Triggers on push to main, weekly on Mondays at 06:15 UTC, and manually via workflow_dispatch.

Diagram

graph TD
  A[Push/Schedule/Manual] --> B["scorecard.yml"] --> C[".github Scorecard Workflow"] --> D[Security Events]

Loading

High-Level Assessment

Using the shared reusable workflow pinned to a commit SHA is the standard, secure approach consistent with other repos in the org; no alternative needed.

Files changed (1) +24 / -0

Other (1) +24 / -0

scorecard.ymlAdd OpenSSF Scorecard reusable workflow caller +24/-0

Add OpenSSF Scorecard reusable workflow caller

• Introduces a new GitHub Actions workflow that calls the org-wide pinned Scorecard reusable workflow on push to main, weekly schedule, and manual dispatch, with minimal required permissions.

.github/workflows/scorecard.yml