Harden the release path and add community docs

[detkin]

Summary

Follow-up from an open-source readiness audit of this repo. Everything here is either a concrete defect or a gap relative to what a public repo with this much traffic should have.

1. install.sh never verified its download

This is the one I'd merge first. The documented install path is a script piped straight into a shell, and it downloaded the release archive, extracted it, and installed the binary to ~/.local/bin without checking anything. A corrupted mirror, a truncated transfer, or a tampered artifact installed silently.

It now fetches the release's checksums.txt, hashes the archive with whichever of sha256sum / shasum the platform provides, and refuses to install on a mismatch — or when the checksums can't be fetched at all, rather than falling back to trusting the download.

2. Build provenance attestation

release.yml now mints a signed provenance statement for the published archives via actions/attest-build-provenance, so users can tie an artifact to this repository and commit:

gh attestation verify sx_Darwin_arm64.tar.gz --repo sleuth-io/sx

Checksums prove the archive matches a hash file published alongside it; attestation proves it came from this build. The job gains id-token: write and attestations: write for this.

3. The Homebrew formula declared the wrong license

.goreleaser.yml had license: MIT. The repository is Apache-2.0. Every formula published through v2.2.8 has told brew info sx the wrong license. One-line fix; takes effect on the next release.

4. Dependabot didn't cover Go modules

dependabot.yml configured github-actions only, so Go dependencies never received update PRs — they'd only ever surface as security alerts after a CVE landed. Added gomod, weekly, grouped for minor/patch.

5. claude-pr-review.yml had no fork guard

Every fork PR triggered the review with empty secrets. Added the guard job pattern: fork PRs and repos without ANTHROPIC_API_KEY skip cleanly, and a missing SKILLS_SITE_API_KEY degrades to a review without installed skills instead of failing.

6. Community docs

Added SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, issue templates, and a PR template — none existed. SECURITY.md points at GitHub private vulnerability reporting (now enabled), so there's a private channel for reports.

Testing

• make prepush — green, all 44 packages pass.
• bash -n install.sh — syntax clean.
• Installer verified against the real v2.2.8 release: downloaded the actual archive and checksums.txt, confirmed the grep/awk extraction matches goreleaser's format, and ran the full script end to end — installs and reports ✓ Checksum verified, then sx --version works.
• Failure path verified: appended a byte to the archive after download; the script reported the mismatch, refused to install, and left nothing in the install dir.
• All changed YAML parses.

Notes

Applied alongside this, via the API rather than in the diff:

Setting	Before	Now
Secret scanning	disabled	enabled
Push protection	disabled	enabled
Dependabot security updates	disabled	enabled
Private vulnerability reporting	disabled	enabled
Default workflow token	write	read
Token can approve PRs	yes	no
Branch protection on main	none	PR + Test required
Topics	none	12
Homepage	unset	https://sleuth-io.github.io/sx/

Dropping the default workflow token to read is safe: release.yml, app-release.yml, pages.yml, and claude-pr-review.yml each declare their own permissions: block, and test.yml needs nothing beyond read. Worth watching the next release run to confirm.

SECURITY.md references attestation as available "from v2.2.9 onward" — accurate if this merges before the next tag, worth a tweak if it doesn't.