[szibis]

Summary

OpenSSF Scorecard had stopped running on pull requests. The Security / static step pulled gcr.io/openssf/scorecard:stable, which that registry no longer serves without billing ("This API method requires billing to be enabled"). The step is allowed to fail, and the guardrail skips an empty report, so no pull request has actually been scored since. This change makes it run again, publishes the result for main, sets a target score, and moves the badge workflows to least-privilege tokens.

Changes

• security-pr.yaml: the PR-time scanner is ghcr.io/ossf/scorecard:v5.6.0, pinned by digest. It is the same Scorecard version ossf/scorecard-action v2.5.0 bundles, so PR and published scores agree. A comment says the pin must follow the action's bundled version, because Dependabot does not update docker run images.
• New .github/workflows/scorecard.yaml:
  • runs ossf/scorecard-action v2.5.0, pinned by SHA, with publish_results: true, on every push to main, weekly, and on dispatch;
  • top-level permissions: read-all, and only id-token: write on the analysis job;
  • keeps the result as an artifact and does not upload it to code scanning, so Scorecard findings do not enter the code-scanning merge gate.
• README: an OpenSSF Scorecard badge.
• ghcr-badges.yaml, loc-badges.yaml: top-level permissions are contents: read, and contents: write moves to the one job that pushes the badges branch.
• docs/security.md: a Scorecard section covering:
  • the PR guardrail;
  • the baseline, 6.9 from a local Scorecard v5.3.0 run against main on 2026-10-21;
  • the target, 8.0 or higher;
  • which checks reach it: Token-Permissions from this change, and Signed-Releases, already partly delivered by signed releases since v2.22.1, which needs .intoto.jsonl provenance assets on releases to reach 10;
  • which checks are process changes.
• docs/testing.md: the scanner pin, and a scorecard.yaml row. CHANGELOG entry.

Proofs

check	result
Scorecard v5.6.0 --local, Token-Permissions	10 on this tree, 0 on main (top-level writes in the badge workflows)
Scorecard v5.3.0 against main (remote, all checks)	6.9 overall
PR-time run as CI does it (--commit) against the current guardrail floors	passes (5.8 against the 5.0 floor on the earlier image)
scorecard-action v2.5.0 publish_results restrictions (no top-level env or defaults, no workflow-level write, allowed steps only, id-token: write on the job)	met
the pinned image and action digests	match the published v5.6.0 and v2.5.0
actionlint (pinned and local), zizmor 1.30.1 (pinned)	clean, no findings
scripts/ci/tests (pin test included)	77 pass
conformance and changelog gates	ok

On merge: the publish path runs for the first time on the next push to main, and the badge shows data after that run.

Not applicable: no proxy code changes, so e2e vs Loki, the Grafana range matrix, visual proof, A/B, benchstat and the load test do not apply.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	11763	11763	0
Coverage	88.4%	88.3%	-0.1% (regressed)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Performance smoke was skipped for this PR because no perf-sensitive paths changed.

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance smoke was intentionally skipped because no perf-sensitive paths changed in this PR.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.