Repository navigation
ci: retire the Scorecard Enforcer, which could never pass - #83
Conversation
scorecard-enforcer.yml has failed on every run. Its two gates cannot pass in this repository: - check-critical requires SECURITY.md. The policy is SECURITY.adoc, as the estate's AsciiDoc rule asks. - check-score reads .runs[0].tool.driver.properties.score from the SARIF. Scorecard's SARIF driver carries only name, informationUri, semanticVersion and rules (ossf/scorecard pkg/scorecard/sarif.go), so jq always falls back to 0 and the gate fails at "0 is below minimum 5". rsr-template-repo carries no enforcer. Scorecard runs here through scorecard.yml, the standards reusable, which publishes and uploads the results. This removes the enforcer and its actions.lock entries: its workflow key and the records only it used (download-artifact v8.0.2, upload-artifact v7.0.2, scorecard-action v2.5.0). codeql-action stays for codeql.yml, and upload-artifact's v7.0.0 record stays for upload-pages-artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely describes the main change: retiring the failing Scorecard Enforcer workflow. |
| Description check | |
The description directly explains why the Scorecard Enforcer is removed, identifies the affected files and action records, and distinguishes the remaining Scorecard workflow from this change. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
✨ Finishing Touches: 💡 1
🛠️ Fix failing CI checks: 💡
- Commit to this branch
- Create a new PR
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
2 participants
Summary
"OpenSSF Scorecard Enforcer" (
.github/workflows/scorecard-enforcer.yml) has failed on every run on main, including 87701b9 before #78–#82 and 230b18e after them. Neither of its gates can pass in this repository:SECURITY.md. The policy here isSECURITY.adoc, as the estate's AsciiDoc rule asks..runs[0].tool.driver.properties.scorefrom the SARIF. Scorecard's SARIF driver carries onlyname,informationUri,semanticVersionandrules(ossf/scorecardpkg/scorecard/sarif.go), sojqalways falls back to0. The job then fails with "Scorecard score 0 is below minimum 5".rsr-template-repo carries no enforcer. Scorecard already runs here through
scorecard.yml, the standards reusable, which publishes and uploads the results.Changes
.github/workflows/scorecard-enforcer.yml.actions.lock: drop its workflow key, and the three records only it used:actions/download-artifact@v8.0.2actions/upload-artifact@v7.0.2ossf/scorecard-action@v2.5.0github/codeql-actionstays forcodeql.yml.upload-artifact's v7.0.0 record stays forupload-pages-artifact.Checks run locally
uses:refs match its lock key exactly. No key is stale, every record is referenced, and no ref lacks a record.bun scripts/check-action-pinning.js: all action refs are pinned (11 resolvable through the lock).validate-actions-lock: passes.Not in this PR
scorecard.ymlfailed on 2026-10-19. Hypatia, Mirror and Secret Scanner fail on main with "invalid lockfile pin", and the estate re-pin to standards75bd599(owner-run) clears all four. This PR doesn't widen into that.Generated by Claude Code