docs(security): document OpenSSF hard evidence

[jkowall]

Summary

• document OpenSSF Gold hard-evidence criteria for OpenSSF Gold: Document reproducible build, coverage, hardened headers, and dynamic analysis evidence #8484
• record the no-fuzzing dynamic-analysis path using maintained race-enabled tests and E2E workflows
• narrow remaining OpenSSF Gold: Document reproducible build, coverage, hardened headers, and dynamic analysis evidence #8484 follow-up to branch-coverage BadgeApp rationale and website hardening headers/constraint

Refs #8484
Refs #8481

Testing

• make fmt
• make lint (passed after temporarily moving/restoring unrelated untracked .claude tree so repo lint did not scan .claude/worktrees)
• make test
• git diff --check

[Copilot]

Pull request overview

Updates Jaeger’s security documentation to provide durable “hard evidence” links and rationale needed for the OpenSSF Best Practices Gold badge follow-ups (tracked in #8484 / #8481), focusing on reproducible builds, coverage, site hardening, and dynamic analysis.

Changes:

• Adds a new “Hard-Evidence Criteria” section with maintained links to CI workflows, Makefile targets, and supporting docs for Gold evidence items.
• Records current rationale/plan for branch coverage (potential N/A) and website security-header constraints/actions.
• Updates the “Last reviewed” date and narrows the remaining work item for #8484 to the unresolved badge-app follow-ups.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.56%. Comparing base (910e6a0) to head (6f37aff).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8585      +/-   ##
==========================================
- Coverage   96.59%   96.56%   -0.03%     
==========================================
  Files         331      331              
  Lines       17566    17566              
==========================================
- Hits        16967    16963       -4     
- Misses        451      454       +3     
- Partials      148      149       +1     

Flag	Coverage Δ
badger_direct	8.94% <ø> (ø)
badger_e2e	1.04% <ø> (ø)
cassandra-4.x-direct-manual	14.55% <ø> (ø)
cassandra-4.x-e2e-auto	1.03% <ø> (ø)
cassandra-4.x-e2e-manual	1.03% <ø> (ø)
cassandra-5.x-direct-manual	14.55% <ø> (ø)
cassandra-5.x-e2e-auto	1.03% <ø> (ø)
cassandra-5.x-e2e-manual	1.03% <ø> (ø)
clickhouse-direct	8.97% <ø> (ø)
clickhouse-e2e	1.16% <ø> (ø)
elasticsearch-6.x-direct	16.87% <ø> (ø)
elasticsearch-7.x-direct	16.91% <ø> (ø)
elasticsearch-8.x-direct	17.05% <ø> (ø)
elasticsearch-8.x-e2e	1.04% <ø> (ø)
elasticsearch-9.x-e2e	1.09% <ø> (+0.04%)	⬆️
grpc_direct	7.90% <ø> (ø)
grpc_e2e	1.04% <ø> (ø)
kafka-3.x-v2	1.04% <ø> (ø)
memory_v2	1.04% <ø> (ø)
opensearch-1.x-direct	16.95% <ø> (ø)
opensearch-2.x-direct	16.95% <ø> (ø)
opensearch-2.x-e2e	1.04% <ø> (ø)
opensearch-3.x-e2e	1.04% <ø> (ø)
query	1.04% <ø> (ø)
tailsampling-processor	0.55% <ø> (ø)
unittests	94.87% <ø> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

CI Summary Report

Metrics Comparison

❌ 36 metric change(s) detected

View changed metrics

For label-level diff details, open the CI run and expand the "Compare metrics and generate summary" step logs.

metrics_snapshot_elasticsearch_9.x_e2e — ⬇️ download diff
3 added

• jaeger_storage_latency
• jaeger_storage_requests
• rpc_server_call_duration

Code Coverage

✅ Coverage 97.3% (baseline 97.3%)

➡️ View CI run | View publish logs
2026-05-20 13:45:27 UTC