chore: adopt the shared skill template

[CybotTM]

Brings .github/ in line with netresearch/.github/templates/skill and adds .github/template.yaml, which is what makes the template drift check apply to this repo from now on.

Correction to the original description

The first version of this description claimed release.yml lacked the id-token: write and attestations: write scopes. That was wrong — all 17 repos in this rollout already had them. The claim came from reading a truncated diff and seeing only the template side of a changed hunk.

What release.yml actually gains is the top-level permissions: {} block and clearer comments. The scopes are unchanged.

What this actually does

• adds .github/template.yaml, so check-template-drift governs this repo from now on
• adds the top-level permissions: {} deny-by-default block to the shared workflows that lacked it
• brings every shared workflow to the current template revision, including the scanner wording corrected in docs(templates): say what the scanner jobs actually run .github#334
• adds the template files this repo did not carry

Why overwriting is safe

Measured across all 17 skill repos in the same position before touching any of them: release.yml and auto-merge-deps.yml exist in exactly one revision each, the remaining files in two or three. No repo carries a local customisation — it is a single generation gap.

The one shape that would be unsafe is a repo hosting its own reusable workflow, since the template ships the caller form: adopting it there replaces the reusable with a stub that uses: itself, which is what broke every skill release org-wide on 2026-06-18. The rollout script refuses any repo containing workflow_call:, and none of the 17 does.

The commit message lists the files added and replaced for this specific repo.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/labeler.yml

Package	Version	License	Issue Type
netresearch/.github/.github/workflows/labeler.yml	main	Null	Unknown License

.github/workflows/scorecard.yml

Package	Version	License	Issue Type
netresearch/.github/.github/workflows/scorecard.yml	main	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/netresearch/.github/.github/workflows/labeler.yml	main	Unknown	Unknown
actions/netresearch/.github/.github/workflows/scorecard.yml	main	Unknown	Unknown

Scanned Files

• .github/workflows/labeler.yml
• .github/workflows/scorecard.yml

[Copilot]

Pull request overview

This PR adopts the shared netresearch/.github/templates/skill setup for this repository’s .github/ directory and adds .github/template.yaml so template drift checks will apply going forward. It also modernizes workflow security posture by denying permissions by default and re-declaring minimal job permissions for each reusable-workflow caller.

Changes:

• Standardize GitHub Actions workflows to the shared template pattern (permissions: {} at top-level, explicit per-job permissions).
• Add new templated workflows for scorecard, labeler, and template drift checking.
• Update security automation configuration (zizmor policy text, Dependabot configuration, richer workflow documentation comments).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/zizmor.yml	Updates the unpinned-uses policy commentary to cover both reusable workflows and composite actions.
.github/workflows/security.yml	Expands documentation and keeps explicit per-job permissions while calling shared security reusables.
.github/workflows/scorecard.yml	Adds OpenSSF Scorecard workflow using the shared reusable with least-privilege permissions.
.github/workflows/release.yml	Adds top-level deny-all permissions and grants required scopes for signing/attestations in the reusable release pipeline.
.github/workflows/lint.yml	Switches to top-level deny-all permissions and explicitly grants read permissions to the reusable validation workflow.
.github/workflows/labeler.yml	Adds labeler workflow using pull_request_target with deny-all + minimal job permissions.
.github/workflows/harness-verify.yml	Switches to deny-all permissions and explicitly grants read permissions for the reusable harness verification.
.github/workflows/eval-validate.yml	Switches to deny-all permissions and explicitly grants read permissions for the reusable eval validation.
.github/workflows/check-template-drift.yml	Adds a workflow to enforce drift checks against the shared skill template.
.github/workflows/auto-merge-deps.yml	Documents and keeps pull_request_target usage while applying deny-all + explicit job permissions for the reusable auto-merge.
.github/template.yaml	Adds template binding/config that enables drift enforcement and documents common intentional drift patterns.
.github/labeler.yml	Adds label rules to categorize PRs based on changed files.
.github/dependabot.yml	Aligns Dependabot config with the template (github-actions + composer ecosystems, grouped updates).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[CybotTM]

Correction: the original description claimed release.yml lacked the id-token/attestations scopes. It did not — all 17 repos already had them, and the claim came from reading a truncated diff. The description has been corrected. What the file actually gains is the top-level permissions: {} block and clearer comments; the scopes are unchanged. The adoption itself stands: template governance, the deny-by-default block, and the current template revision.