Add OpenSSF Scorecard analysis and live README badge

[abhi1693]

What changes and why?

DevFeed has no published OpenSSF Scorecard result. Add an independent supply-chain analysis workflow and a live README badge that links to the detailed results.

The workflow runs on pushes to master, weekly on Mondays at 18:19 UTC, and branch-protection changes. It uses GitHub-hosted Ubuntu 24.04, skips forks, limits write permissions to the analysis job, disables persisted checkout credentials, and pins all actions to verified commit SHAs. Scorecard v2.4.4 publishes through OIDC, retains SARIF artifacts for five days, and uploads findings to code scanning under its own category. The checkout and CodeQL pins match the repository's existing workflows.

The repository is public and uses GitHub repository rulesets, which Scorecard can read with the default GITHUB_TOKEN; no extra PAT or secret is required. The setup follows the official installation and publishing guidance.

Validation

• actionlint v1.7.12 passes for the new workflow; the downloaded validator's official release checksum was verified.
• YAML validation and explicit checks pass for publication restrictions, allowed steps, full SHA pins, least-privilege permissions, default-branch triggers, and SARIF paths.
• Action versions/commits were checked against the upstream workflow and release references.
• README badge/viewer links use the official repository-specific format. The viewer and badge URLs respond successfully. The results API currently returns 404 and the badge shows invalid repo path, pending the first published repository result.
• Repository commit hooks and git diff --check pass.
• The initial CI performance comparison flagged topic-feed p95 from 76 ms to 97 ms despite identical application source on both revisions. A full CI rerun was requested to collect six fresh independent samples; its result is pending.
• Publishing needs the first successful default-branch run after merge. It is intentionally not enabled on pull requests; a published score cannot be verified from this branch.

Rollout notes

Merging starts the initial scan through the master push trigger. The badge will show the actual published score once that scan succeeds. This PR is independent of the authentication logging fix in #69.

Ready for review

• The description explains the change and the validation results, including any gaps.
• Relevant documentation is updated; no application behavior changes require regression tests.

[github-actions]

PR reader API performance

Result: INCONCLUSIVE

8 inconclusive. Zero request failures across all six runs.

Base ba167ee74677d8d2b6321b92697933b3a40af6e0 → PR d5ebef125fe9ce3d1907eea5cdf76672da7afd0b

Three independent runs per revision, each on a fresh GitHub-hosted ARM64 runner. 16 users, 60 seconds/run, 1,000 synthetic articles, cache off, five PgBouncer slots.

Latency comparison

All latency values are in milliseconds; lower is better. Values are medians of three runs.

Route	Base p95	PR p95	Change	Result
All requests	95	99	+4 (+4.2%)	Inconclusive
Latest feed	120	130	+10 (+8.3%)	Inconclusive
Feed pagination	82	97	+15 (+18.3%)	Inconclusive
Article detail	73	83	+10 (+13.7%)	Inconclusive
Source feed	82	89	+7 (+8.5%)	Inconclusive
Topic feed	81	89	+8 (+9.9%)	Inconclusive
Feed filters	61	69	+8 (+13.1%)	Inconclusive
Sources	41	40	-1 (-2.4%)	Inconclusive
Topics	36	49	+13 (+36.1%)	Inconclusive

Additional latency and throughput metrics

Each cell shows base → PR. Latencies are in milliseconds.

Endpoint	p50	p99	Requests/s
Aggregated	28 → 28	140 → 140	29.94 → 30.11
/v1/feed [latest]	45 → 45	160 → 160	9.10 → 8.73
/v1/feed [page]	26 → 28	120 → 140	3.93 → 3.69
/v1/articles/[id]	18 → 18	110 → 110	6.35 → 6.32
/v1/feed [source]	30 → 26	110 → 120	1.74 → 1.87
/v1/feed [topic]	26 → 27	110 → 130	1.90 → 1.99
/v1/feed/options	20 → 21	110 → 110	2.38 → 2.47
/v1/sources	12 → 12	54 → 82	2.38 → 2.47
/v1/topics	11 → 12	55 → 85	2.38 → 2.47

Individual runs

Run	Requests	Failures	Exit code
Base 1	1717	0	0
Base 2	1681	0	0
Base 3	1666	0	0
PR 1	1712	0	0
PR 2	1678	0	0
PR 3	1691	0	0

How to interpret this report

Regressed / Improved: a p95 regression needs >20% and >20 ms increase in the medians and at least two head samples versus the base median. Improvements use the inverse threshold. Within threshold means the change did not meet both thresholds.

Inconclusive: a within-revision p95 range >35% of its median and >20 ms is too noisy for a confident latency verdict.

Inconclusive latency comparisons are non-blocking: the check passes without claiming an improvement. Confirmed regressions and test/report errors fail the PR gate. Throughput is descriptive: paced users do not measure maximum capacity. This uncached public API test does not establish production health, browser performance or worker capacity. Separate runners can differ in hardware or host load; repetitions and noise checks reduce but cannot eliminate that uncertainty.

Full HTML/CSV reports and logs · attempt 4