Skip to content

ci(queue): gate Scorecard on repository visibility (green while private) #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
msalvatti merged 2 commits into from
Jun 27, 2026
Merged

ci(queue): gate Scorecard on repository visibility (green while private) #8

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c432f4a
ci(queue): gate Scorecard on repo visibility so it passes while private
msalvatti Jun 27, 2026
9d04d24
ci(queue): make Scorecard visibility check fail-safe to private on AP…
msalvatti Jun 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions .github/workflows/scorecard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,41 @@ permissions:
contents: read

jobs:
# OpenSSF Scorecard requires a public repository — its checkout cannot authenticate
# against a private repo. Gate the analysis on visibility so the workflow stays green
# (the analysis job is skipped) while the repository is private, and runs automatically
# once the repository becomes public — no workflow change required.
gate:
name: Resolve repository visibility
runs-on: ubuntu-latest
permissions:
contents: read
outputs:
public: ${{ steps.vis.outputs.public }}
steps:
- name: Harden runner
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
with:
egress-policy: audit

- name: Determine visibility
id: vis
env:
GH_TOKEN: ${{ github.token }}
run: |
# Fail safe: any API/CLI error defaults to private, so a transient gh failure
# skips the analysis (run stays green) instead of failing the whole workflow.
if visibility="$(gh api "repos/${{ github.repository }}" --jq '.visibility' 2>/dev/null)" \
&& [ "$visibility" = "public" ]; then
echo 'public=true' >> "$GITHUB_OUTPUT"
else
echo 'public=false' >> "$GITHUB_OUTPUT"
fi

analysis:
name: Scorecard analysis
needs: gate
if: ${{ needs.gate.outputs.public == 'true' }}
runs-on: ubuntu-latest
permissions:
security-events: write
Expand Down
Loading