Release hygiene: fix config drift and close gold-standard gaps

[dean0x]

An audit used this repo as the reference template for release-readiness of another project. It's a strong template, but a few items of config drift and some gaps against a "gold standard" release bar surfaced. Filing them here to fix later.

Config drift (small, factual fixes)

1. Repo homepage points at the wrong slug: https://github.com/dean0x/mds#readme → should be …/mdscript#readme (the package manifests already use the correct URL).
2. .github/ISSUE_TEMPLATE/config.yml links to /discussions, but Discussions is disabled → enable Discussions or repoint the contact link.
3. SECURITY.md supported-versions table is stale (says 0.1.x; current release is v0.3.0) → replace the table with a rolling statement ("the latest 0.x release receives security fixes") so it can't rot again.
4. CODE_OF_CONDUCT.md still missing (tracked in Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1) #38) — folded in here for visibility.
5. workflow_dispatch release path is still broken against protected main (release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127) — consider deleting the prepare push-to-main job in favor of a pure tag-driven flow (bump via PR, tag the merge commit), which designs the failure out instead of working around it.

Gold-standard gaps

The bar used for the audit:

• (a) Every public claim is CI-verified — declared MSRV is checked (✅ already done here), claimed commit conventions are enforced, docs can't silently drift from settings.
• (b) Supply chain — all actions SHA-pinned with Dependabot keeping pins fresh; OIDC trusted publishing (no long-lived registry tokens); npm provenance; cargo-deny gating advisories/licenses.
• (c) Release integrity — checksummed release artifacts + build-provenance attestations; a dry-run path exercising the full build matrix (✅ already done here); idempotent, safely re-runnable publish steps.
• (d) Self-consistency — repo settings, templates, and health files agree with each other.
• (e) Protection that doesn't fight automation — branch protection with the release path designed around it.

Against that bar:

• Registry auth uses long-lived secrets (CARGO_REGISTRY_TOKEN, NPM_TOKEN); both crates.io and npm support OIDC trusted publishing — switch, then delete the tokens.
• Only the composite action's internals are SHA-pinned; workflow-level actions float on major tags — pin all uses: to full SHAs (the github-actions Dependabot ecosystem is already configured, so pins stay fresh).
• GitHub Releases carry no artifacts or checksums — attach a SHA256SUMS (and optionally the platform artifacts), and add build-provenance attestations (actions/attest-build-provenance).
• No cargo-deny/cargo-audit gate in CI (already noted as a follow-up in Cargo.toml comments).
• publish-crates waits on the index with sleep 30 between mds-core and mds-cli — replace with a poll of the crates.io index for the exact version.
• Publish failures are downgraded to warnings ("may already exist") — replace with explicit idempotency checks (query the registry for the exact version; skip if present, hard-fail on anything else).
• Conventional Commits are claimed in CONTRIBUTING and the PR template but not enforced — add a PR-title lint or soften the claim.
• Optional: OpenSSF Scorecard workflow + badge; coverage reporting.

[dean0x]

Reconciliation against main (2026-08-09 sweep) — 10 of 13 still real

Re-verified every claim. Three are now fixed by PR #287 (cb44b56); the rest stand.

Fixed — strike these

• Config drift tech-debt: lower-priority refactorings (call_stack, error strings, exit codes, cycle detection) #5 — workflow_dispatch release path broken against protected main (release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127) — done. chore: harden release machinery (5 independent fixes) #287 Fix 4 deleted the prepare push-to-main job entirely; the workflow now has exactly two entry points (tag push → full release, bare dispatch → dry-run). This is the "design the failure out" resolution this issue recommended. release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127 closed.
• Gold-standard: publish-crates waits with sleep 30 — done. chore: harden release machinery (5 independent fixes) #287 Fix 2 replaced it with a bounded crates.io sparse-index poll (max 20 x 15 s = 5 min, then hard fail). release.yml:190-211.
• Gold-standard: publish failures downgraded to warnings — done. chore: harden release machinery (5 independent fixes) #287 Fix 2 replaced cargo publish || true with an explicit idempotency check: success → proceed; "already uploaded" → notice and continue; anything else → exit 1. release.yml:180-188, :215-223.

Still real — verified today

Config drift (all trivial, all pre-tag):

1. Homepage slug still wrong. gh api repos/dean0x/mdscript --jq .homepage returns https://github.com/dean0x/mds#readme. Should be .../mdscript#readme. One settings edit.
2. Dead /discussions link. has_discussions: false, yet .github/ISSUE_TEMPLATE/config.yml still offers "Question or discussion" pointing at https://github.com/dean0x/mdscript/discussions. Enable Discussions or drop the contact link.
3. SECURITY.md stale support table. Lines 25-30 still read 0.1.x ✅ / < 0.1.0 ❌ — and sit two lines below the rolling statement ("Security fixes are applied to the latest released minor series only") that was meant to replace them. The table now directly contradicts the sentence above it, and it will read as "v0.4.0 unsupported" the moment v0.4.0 ships. Deleting the table is the fix.
4. CODE_OF_CONDUCT.md still missing (Add CODE_OF_CONDUCT.md (Contributor Covenant 2.1) #38, still open on the v0.2.0 milestone).

Gold-standard gaps (all post-tag except as noted):

• OIDC trusted publishing for crates.io + npm; delete CARGO_REGISTRY_TOKEN / NPM_TOKEN.
• SHA-pin workflow-level uses:. Current state: 2 of 49 refs pinned — both inside .github/actions/setup-wasm/ (jetli/wasm-pack-action, phi-ag/setup-binaryen); the other 47 float on major tags. Tracked in detail in ci: SHA-pin GitHub Actions + assert lockfile version in verify-versions.mjs #163.
• Release artifacts: no SHA256SUMS, no actions/attest-build-provenance.
• No cargo-deny/cargo-audit gate — ci: add cargo-deny / cargo-audit supply-chain gate #136.
• Conventional Commits claimed in CONTRIBUTING + PR template but unenforced.
• Optional: OpenSSF Scorecard, coverage.

Recommendation: items 1-4 are minutes of work and are the ones a reader of the v0.4.0 release will actually hit. Do those pre-tag; leave the gold-standard block for v0.5.0.