fix: scorecard publish_results=false; add SECURITY.md#37
Merged
Conversation
scorecard/action.yml: - Change publish_results default from true to false. The scorecard webapp verifies the calling workflow directly invokes ossf/scorecard-action as a job step; composite action wrapping hides that call so publication always fails with 400 "workflow has no job that calls ossf/scorecard-action". SARIF still uploads to GitHub Security tab. Callers wanting public database publication must call ossf/scorecard-action directly. - Update description to document the architectural constraint. README.md: - Add note explaining the publish_results composite-action limitation with workaround instructions. SECURITY.md: - Add security policy satisfying scorecard Security-Policy check criteria: email contact, HTTPS URL, free-form disclosure text, vuln/disclosure keywords, 30/90-day timeline. - Improves scorecard Security-Policy score from 0 → expected 10. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The .github/** paths filter caused CI to skip on doc/README-only pushes. This improved SAST and CI-Tests scorecard checks require CI to run on every commit to main to score higher. Remove the filter so all pushes trigger the full job matrix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…hen publish_results warning ci.yml: - Remove id-token: write from scorecard job — publish_results defaults to false, no OIDC token is ever consumed; permission was dangling over-privilege - Simplify scorecard if: condition — github.ref == 'refs/heads/main' already excludes PRs (they use refs/pull/*/merge), making the event_name check redundant scorecard/action.yml: - Remove id-token: write from required permissions in description - Upgrade publish_results warning from NOTE to WARNING with explicit HTTP 400 error message; input retained for callers who read docs but footgun is clear README.md: - Remove id-token: write from scorecard example and prose - Update table row: publish_results default was incorrectly shown as true - Warn callers explicitly that setting publish_results: true always fails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The OpenSSF Scorecard job failed on the first run after merge with:
Root cause: the scorecard webapp verifies that the calling workflow directly invokes
ossf/scorecard-actionas a job step. Because we wrap it in a composite action (uses: ./.github/actions/scorecard), the webapp can't see the direct call and rejects publication with a 400.This is a fundamental architectural constraint — composite action wrapping and
publish_results: trueare incompatible.Fix
publish_resultsdefault tofalsein the composite actiondescriptionto document the constraint and workaround> Noteblock to README explaining the limitationBonus: SECURITY.md
Scorecard
Security-Policycheck scored 0/10 because noSECURITY.mdexisted. Added one with:vuln/disclos/timeline keywords (satisfies specific-text requirement)Expected improvement: Security-Policy 0 → 10, overall score 7.0 → ~7.5+
Scorecard score from first run (7.0/10)
🤖 Generated with Claude Code