Governance: remediate html4tree Scorecard alerts and disabled security surfaces

[seonghobae]

Scope

ContextualWisdomLab/html4tree still exposes repository-governance findings while PR #170 source and dependency gates are clean on current head 1bc3a63c7ac24353497794c14de5fbb2a7720295.

Current evidence

• current-head CI build, JaCoCo verification, CodeQL, Semgrep, Trivy, OSV, dependency review and Scorecard checks pass
• current Security Scan log emits no actual warning or error annotations
• open code-scanning governance alerts remain from the 2026-07-13 Scorecard analysis:
  • alert 🛡️ Sentinel: Add organization-wide default security policy #2 DependencyUpdateToolID, High: no version-update tool configuration detected
  • alert Add Palette journal for profile repo #1 BinaryArtifactsID, High: gradle/wrapper/gradle-wrapper.jar
  • alert Add OpenCode review merge automation #4 SecurityPolicyID, Medium: no repository security policy detected
• repository issues are disabled, so ordinary governance tracking cannot live in the target repository
• private vulnerability reporting and Dependabot security updates are enabled
• secret scanning, non-provider patterns, validity checks, and push protection are disabled and require an explicit repository-setting decision

Required governance decisions

• centralize or add a discoverable SECURITY.md without inventing an unsupported contact path
• add a pinned .github/dependabot.yml for Gradle/GitHub Actions version updates, separate from already-enabled security updates
• preserve the Gradle wrapper only with verified provenance/integrity and record a bounded Scorecard dismissal rationale if it remains intentional; do not delete the build bootstrap blindly
• decide explicitly whether to enable the currently disabled secret-scanning surfaces
• re-run Scorecard/SARIF on current default-branch state and close only alerts proven remediated or intentionally governed

[seonghobae]

Source-managed remediation is now in ContextualWisdomLab/html4tree#331 (current head 33688e35b9b99dafff98065945be1f69c885ab7e).

Implemented and locally verified:

• Gradle and GitHub Actions Dependabot coverage targeting master
• repository-local private-reporting entry point with the organization policy retained as the single source of truth
• CI verification of the checked-in Gradle 5.1.1 wrapper JAR against the published SHA-256
• distributionSha256Sum for the Gradle 5.1.1 binary distribution
• JDK 11 full build/tests/JaCoCo, actionlint, YAML parsing, and checksum checks passed

The issue remains open for the approval-bound repository settings (secret scanning / push protection surfaces) and for post-merge governance disposition of the intentionally checked-in, checksum-verified wrapper JAR alert.