chore: add repo dev tooling to mirror the main project

Add Renovate config (docker + github-actions managers; the wrapped Provenant
image tag stays manually pinned per action release), AGENTS.md/CLAUDE.md agent
guidance, SECURITY.md and CONTRIBUTING.md pointing at the main project, and a PR
template. Brings the action repo's conventions in line with getprovenant/provenant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Maxim Stykow <maxim@mirelo.ai>

Author: mstykow

.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Summary
+
+-
+
+## How to verify
+
+<!-- How to exercise this change beyond what CI runs. If the CI self-test fully covers it, say so. -->
+
+-
+
+## Checklist
+
+- [ ] Commits are signed off (`git commit -s`, DCO)
+- [ ] SPDX headers present on any new source files
+- [ ] Third-party GitHub Actions pinned by SHA

AGENTS.md

@@ -0,0 +1,45 @@
+# Agent Guidelines for provenant-action
+
+This repository is the **GitHub Action** wrapper for [Provenant](https://github.com/getprovenant/provenant),
+the Rust, ScanCode-compatible license/copyright/SBOM scanner. It is intentionally tiny: it does not
+contain the scanner, only a thin Docker container action that runs the published image.
+
+## What this repo is
+
+- A Docker container action (`runs.using: docker`). It builds a wrapper image that `FROM`s
+  `ghcr.io/getprovenant/provenant` and adds a static busybox `sh` so `entrypoint.sh` can map the
+  action inputs onto a `provenant scan` command line.
+- The scanner itself, its docs, and its release pipeline live in the main repo
+  [`getprovenant/provenant`](https://github.com/getprovenant/provenant). Behavior questions about
+  scanning, flags, or output belong there.
+
+## Key files
+
+- `action.yml` — action metadata, inputs, and the fixed positional arg order passed to the entrypoint.
+- `Dockerfile` — the wrapper image. Its `FROM ghcr.io/getprovenant/provenant:<tag>` line **pins the
+  wrapped Provenant version** for a given action release.
+- `entrypoint.sh` — assembles and execs `provenant scan` from the four positional inputs. Keep it
+  POSIX `sh` (busybox), and keep `paths`/`args` word-splitting intentional (see the inline comments).
+- `.github/workflows/ci.yml` — self-test that runs the action against `testdata/`.
+
+## Conventions (mirror the main repo)
+
+- Every source file carries SPDX headers (`SPDX-FileCopyrightText` + `SPDX-License-Identifier: Apache-2.0`).
+- Sign off commits with `git commit -s` (DCO).
+- Use Conventional Commits for commit messages and PR titles.
+- Pin third-party GitHub Actions by commit SHA (with a trailing `# vN` comment), matching the main repo.
+
+## Versioning and releases
+
+- The wrapped Provenant version is selected by the `FROM` tag in the `Dockerfile`, **not** by a
+  call-time input (GitHub Actions forbids expressions in a container action's image reference).
+- Cutting an action release: bump the `Dockerfile` `FROM` tag to a concrete, working Provenant
+  version, tag `vX.Y.Z`, and move the floating `vX` tag. Consumers pin `@vN` or a full SHA.
+
+## Current caveat
+
+The published `ghcr.io/getprovenant/provenant:latest` is a known-broken glibc build; a musl-static
+rebuild is merged upstream but not yet released. Until that release ships, the CI self-test's scan
+step is expected to fail and is guarded with `continue-on-error`. **Once a working image is
+published, pin the `Dockerfile` `FROM` to that version and remove `continue-on-error` from
+`.github/workflows/ci.yml`** so the self-test actually gates.

CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

CONTRIBUTING.md

@@ -0,0 +1,26 @@
+# Contributing to provenant-action
+
+Thanks for helping improve the Provenant GitHub Action. This is a small wrapper repository; the
+scanner and its contributor guide live in the main project,
+[`getprovenant/provenant`](https://github.com/getprovenant/provenant/blob/main/CONTRIBUTING.md).
+
+## Ground rules
+
+- **Sign off your commits** with `git commit -s` (Developer Certificate of Origin).
+- Use **Conventional Commits** for commit messages and PR titles (e.g. `fix:`, `feat:`, `docs:`, `ci:`).
+- Keep every source file's **SPDX headers** intact (`SPDX-FileCopyrightText` + `SPDX-License-Identifier: Apache-2.0`).
+- Pin any third-party GitHub Action by commit SHA with a trailing `# vN` comment.
+- Read [`AGENTS.md`](AGENTS.md) for the repo layout, how the wrapper image works, and the release flow.
+
+## Testing a change
+
+The `.github/workflows/ci.yml` self-test runs the action against the committed fixture in `testdata/`.
+Run the action locally by building the image and invoking the entrypoint, e.g.:
+
+```sh
+docker build -t provenant-action-dev .
+docker run --rm -v "$PWD:/github/workspace" -w /github/workspace provenant-action-dev \
+  testdata json-pp - "--license --package"
+```
+
+Behavior questions about scanning, flags, or output belong in the main repository.

SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+This repository is the GitHub Action wrapper for [Provenant](https://github.com/getprovenant/provenant).
+Most security-relevant behavior lives in the scanner itself; please report issues through the main
+project's policy.
+
+## Reporting a Vulnerability
+
+Do not disclose suspected security issues in public issues, discussions, or pull requests first.
+
+- Prefer GitHub's private vulnerability reporting flow on this repository, or report through the main
+  project's policy: <https://github.com/getprovenant/provenant/security/policy>.
+- If a private reporting path is not available, open a minimal public issue requesting a secure
+  contact channel, without exploit details or proof-of-concept code.
+
+Please allow a reasonable window for a fix before any public disclosure.