Zero-infra hosted-runner lane + TCG fallback; lead README with Falco proof

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  # Go module dependencies.
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "deps"
+    groups:
+      go-deps:
+        patterns:
+          - "*"
+
+  # Versions of the actions pinned in our workflows.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "ci"
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/bpfcompat-example-hosted.yml

@@ -0,0 +1,94 @@
+name: bpfcompat-example-hosted
+
+# Zero-infrastructure on-ramp: this runs the full QEMU VM compatibility gate on a
+# stock GitHub-hosted runner. No self-hosted runner is required. GitHub-hosted
+# Linux runners now expose /dev/kvm, so VM validation is hardware-accelerated;
+# if a runner ever lacks KVM, bpfcompat degrades to TCG software emulation
+# (correct results, slower) instead of failing.
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "cmd/**"
+      - "internal/**"
+      - "validator/**"
+      - "examples/**"
+      - "matrices/**"
+      - "vm/**"
+      - "action.yml"
+      - "Makefile"
+      - "go.mod"
+      - "go.sum"
+      - ".github/workflows/bpfcompat-example-hosted.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  compatibility-gate:
+    name: Compatibility Gate (hosted runner)
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Report KVM acceleration status
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -e /dev/kvm ]]; then
+            echo "::notice::/dev/kvm present - VM validation is hardware-accelerated."
+          else
+            echo "::warning::/dev/kvm not found - falling back to TCG software emulation (slower, still correct)."
+          fi
+
+      - name: Install host dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-system-x86 qemu-utils clang llvm libbpf-dev libelf-dev zlib1g-dev \
+            pkg-config jq
+
+      - name: Build validator and fixture artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          make validator-static
+          make examples
+
+      - name: Fetch VM image for dev-one profile
+        shell: bash
+        run: |
+          set -euo pipefail
+          make vm-ubuntu-22
+
+      - name: Run bpfcompat action
+        uses: ./
+        with:
+          suite: suites/dev-functional.yaml
+          suite-out: reports/ci-dev-functional-suite.json
+          suite-markdown: reports/ci-dev-functional-suite.md
+          timeout: 12m
+          concurrency: "1"
+          build: "true"
+
+      - name: Upload reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: bpfcompat-reports-${{ github.run_id }}
+          if-no-files-found: warn
+          path: |
+            reports/ci-dev-functional-suite.json
+            reports/ci-dev-functional-suite.md
+            reports/suites/dev-functional/*.json
+            reports/suites/dev-functional/*.md
+            .bpfcompat/runs/**/targets/**/serial.log
+            .bpfcompat/runs/**/targets/**/libbpf.log
+            .bpfcompat/runs/**/targets/**/validator-result.json
+            .bpfcompat/runs/**/targets/**/validator.stderr

.github/workflows/codeql.yml

@@ -0,0 +1,49 @@
+name: codeql
+
+# Static analysis for the Go code (cmd/, internal/) via GitHub CodeQL.
+# build-mode: none analyzes the source directly, so this does not need the
+# C/libbpf validator toolchain. Results surface under Security > Code scanning.
+#
+# Security note: no untrusted ${{ github.event.* }} value is interpolated into
+# any run: shell here, so workflow-injection via PR titles/branches does not
+# apply to this file.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "27 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (Go)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: go
+          build-mode: none
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:go"

.github/workflows/firecracker-preflight.yml

@@ -1,7 +1,9 @@
 name: firecracker-preflight
 
-# Firecracker executable proof. This requires a self-hosted x64 KVM runner
-# because GitHub-hosted runners do not expose /dev/kvm.
+# Firecracker executable proof. This uses a self-hosted x64 KVM runner for the
+# full Firecracker toolchain (Firecracker binary, busybox, cpio, uncompressed
+# guest kernel). The default QEMU lane runs on stock GitHub-hosted runners,
+# which now expose /dev/kvm (see bpfcompat-example-hosted.yml).
 
 on:
   workflow_dispatch:

.github/workflows/scorecard.yml

@@ -0,0 +1,57 @@
+name: scorecard
+
+# OpenSSF Scorecard supply-chain risk assessment. Publishes results to the
+# public Scorecard API (so the README badge resolves) and uploads SARIF to
+# GitHub code scanning.
+#
+# Security note: no untrusted ${{ github.event.* }} value is interpolated into
+# any run: shell here, so workflow-injection does not apply to this file.
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "41 5 * * 1"
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      security-events: write   # upload SARIF to code scanning
+      id-token: write          # publish results to the Scorecard API
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@v2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

CHANGELOG.md

@@ -8,6 +8,19 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once a
 ## [Unreleased]
 
 ### Added
+- Supply-chain trust signals: GitHub CodeQL static analysis
+  (`.github/workflows/codeql.yml`), OpenSSF Scorecard
+  (`.github/workflows/scorecard.yml`), and Dependabot
+  (`.github/dependabot.yml`, Go modules + pinned actions). README gains CI,
+  CodeQL, Scorecard, and license badges; `docs/supply-chain.md` documents the
+  controls and the maintainer-side repo settings (branch protection, secret
+  scanning, OpenSSF Best Practices registration). SBOM + cosign keyless signing
+  already shipped in `release-artifacts.yml`.
+- Zero-infrastructure CI on-ramp: `.github/workflows/bpfcompat-example-hosted.yml`
+  runs the full QEMU VM compatibility gate on a stock GitHub-hosted
+  `ubuntu-latest` runner. GitHub-hosted Linux runners now expose `/dev/kvm`, so
+  no self-hosted runner is required for the default lane. The README now leads
+  with this path and with the Falco `modern_bpf` 5-kernel proof.
 - `bpfcompat kernel-freshness`: compares the kernel release each VM profile
   last validated (`vm/kernel-baselines.yaml`) against the per-distro kernel
   inventory published weekly by falcosecurity/kernel-crawler, flagging
@@ -27,6 +40,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once a
   --count N` generates the derived profiles and matrix from the
   kernel-crawler inventory. Ubuntu only for now.
 
+### Changed
+- QEMU executor falls back to TCG software emulation when `/dev/kvm` is absent
+  (`-accel tcg -cpu max`) instead of failing the launch, so VM validation stays
+  correct on runners without hardware virtualization (just slower). Hosted-KVM
+  runners keep `-enable-kvm -cpu host`.
+
 ## [0.1.5] - 2026-06-11
 
 ### Fixed