security: establish focused ssi-jwt advisory fork

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -Dwarnings
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - run: cargo fmt --all -- --check
+      - run: cargo check --locked --all-targets
+      - run: cargo clippy --locked --all-targets -- -D warnings
+      - run: cargo test --locked
+      - name: Reject removed vulnerable dependency
+        shell: bash
+        run: |
+          if cargo tree --locked | grep -Eq 'serde_with v(1|2)\.'; then
+            echo "serde_with 1.x/2.x must not re-enter this fork" >&2
+            exit 1
+          fi

.github/workflows/organization-quality.yml

@@ -0,0 +1,15 @@
+name: Organization quality
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  policy:
+    uses: ElevenID/.github/.github/workflows/quality-workflows.yml@9b6141e294da5c0f9254cfaa60c8934df95ec68b
+    with:
+      policy-ref: 9b6141e294da5c0f9254cfaa60c8934df95ec68b

.github/workflows/sync-upstream.yml

@@ -0,0 +1,67 @@
+name: Review upstream drift
+
+on:
+  schedule:
+    - cron: "11 8 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sync-upstream
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+        with:
+          fetch-depth: 0
+      - name: Create upstream subtree branch
+        id: split
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "elevenid-upstream-sync[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git remote add upstream https://github.com/spruceid/ssi.git
+          git fetch --prune upstream main
+          split_commit="$(git subtree split --prefix=crates/claims/crates/jwt upstream/main)"
+          git switch -C automation/sync-upstream origin/main
+          if git merge-base --is-ancestor "$split_commit" HEAD; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if ! git merge --no-edit "$split_commit"; then
+            git merge --abort
+            echo "conflict=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          git push --force-with-lease origin automation/sync-upstream
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+      - name: Report conflict
+        if: steps.split.outputs.conflict == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh label create upstream-sync --color 1d76db --description "Automated upstream synchronization" --force
+          issue="$(gh issue list --state open --search 'Upstream synchronization conflict in:title' --json url --jq '.[0].url')"
+          if [ -z "$issue" ]; then
+            gh issue create --title "Upstream synchronization conflict" --label upstream-sync --body "The latest spruceid/ssi ssi-jwt subtree conflicts with the ElevenID security patch. Resolve and rerun the complete fork suite manually."
+          else
+            gh issue comment "$issue" --body "The conflict remains; see $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
+          fi
+          exit 1
+      - name: Create or refresh reviewed sync pull request
+        if: steps.split.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh label create upstream-sync --color 1d76db --description "Automated upstream synchronization" --force
+          gh pr create --base main --head automation/sync-upstream --title "chore: review upstream ssi-jwt" --label upstream-sync --body "History-preserving subtree update from spruceid/ssi. This never merges automatically and must retain the security delta and pass all checks." || gh pr edit automation/sync-upstream --title "chore: review upstream ssi-jwt" --body "History-preserving subtree update from spruceid/ssi. This never merges automatically and must retain the security delta and pass all checks."

.gitignore

@@ -0,0 +1 @@
+/target/