Merge main to dev

.github/CODEOWNERS

@@ -1 +1 @@
-* @DonFungible @edisonz0718
+* @DonFungible @edisonz0718 @jacob-tucker @AndyBoWu

.github/workflows/publish-package.yaml

@@ -3,8 +3,9 @@ name: Publish to npm, Tag and GH Release
 on:
   push:
     branches:
-      - master
       - main
+    paths:
+      - 'packages/core-sdk/package.json'
 
 jobs:
   # Add  timestamp
@@ -14,7 +15,6 @@ jobs:
       - name: Generate timestamp
         run: |
           echo "TIMESTAMP=$(TZ='America/Los_Angeles' date +'%Y-%m-%d %H:%M:%S')" >> $GITHUB_ENV
-          echo ${{ github.head_ref }}
 
       - name: Print timestamp
         run: |

.github/workflows/scorecards.yml

@@ -0,0 +1,44 @@
+name: Scorecards supply-chain security
+on:
+  workflow_dispatch:
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecards analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+        with:
+          persist-credentials: false
+
+      # This is a pre-submit / pre-release.
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@main
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
+        with:
+          sarif_file: results.sarif