From 8592db64e23ed6fe371f6da214efbbf2ca5ec3fc Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 14:08:11 +0000 Subject: [PATCH] ci: retire the Scorecard Enforcer, which could never pass scorecard-enforcer.yml has failed on every run. Its two gates cannot pass in this repository: - check-critical requires SECURITY.md. The policy is SECURITY.adoc, as the estate's AsciiDoc rule asks. - check-score reads .runs[0].tool.driver.properties.score from the SARIF. Scorecard's SARIF driver carries only name, informationUri, semanticVersion and rules (ossf/scorecard pkg/scorecard/sarif.go), so jq always falls back to 0 and the gate fails at "0 is below minimum 5". rsr-template-repo carries no enforcer. Scorecard runs here through scorecard.yml, the standards reusable, which publishes and uploads the results. This removes the enforcer and its actions.lock entries: its workflow key and the records only it used (download-artifact v8.0.2, upload-artifact v7.0.2, scorecard-action v2.5.0). codeql-action stays for codeql.yml, and upload-artifact's v7.0.0 record stays for upload-pages-artifact. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t --- .github/workflows/actions.lock | 21 ----- .github/workflows/scorecard-enforcer.yml | 111 ----------------------- 2 files changed, 132 deletions(-) delete mode 100644 .github/workflows/scorecard-enforcer.yml diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 60c630b..1978208 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -33,12 +33,6 @@ workflows: - 'actions/checkout@v7.0.1' '.github/workflows/runtime-policy.yml': - 'actions/checkout@v7.0.1' - '.github/workflows/scorecard-enforcer.yml': - - 'actions/checkout@v7.0.1' - - 'actions/download-artifact@v8.0.2' - - 'actions/upload-artifact@v7.0.2' - - 'github/codeql-action@v4.38.3' - - 'ossf/scorecard-action@v2.5.0' '.github/workflows/scorecard.yml': [] '.github/workflows/secret-scanner.yml': [] '.github/workflows/security-policy.yml': @@ -61,21 +55,11 @@ dependencies: commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346' owner_id: 44036562 repo_id: 438112499 - 'actions/download-artifact@v8.0.2': - ref: 'v8.0.2' - commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333' - owner_id: 44036562 - repo_id: 192626254 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f': ref: 'v7.0.0' commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' owner_id: 44036562 repo_id: 192625955 - 'actions/upload-artifact@v7.0.2': - ref: 'v7.0.2' - commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9' - owner_id: 44036562 - repo_id: 192625955 'actions/upload-pages-artifact@v5.0.0': ref: 'v5.0.0' commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9' @@ -103,11 +87,6 @@ dependencies: commit: 'sha1-00cae500b08a931fb5698e11e79bfbd38e612a38' owner_id: 15093472 repo_id: 174679242 - 'ossf/scorecard-action@v2.5.0': - ref: 'v2.5.0' - commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e' - owner_id: 67707773 - repo_id: 421101922 'peter-evans/repository-dispatch@v4.0.1': ref: 'v4.0.1' commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697' diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index 30135b9..0000000 --- a/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,111 +0,0 @@ -# This workflow is managed by gh actions-lock. -# SPDX-License-Identifier: MPL-2.0 -# This workflow is managed by gh actions-lock. -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' # Weekly on Monday - workflow_dispatch: - -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates do not pile up queued runs against the shared account-wide -# Actions concurrency pool. Applied only to read-only check workflows -# (no publish/mutation), so cancelling a superseded run is always safe. -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - # The OSSF Scorecard publish endpoint enforces a hard contract: the job that - # runs `ossf/scorecard-action` with `publish_results: true` must contain - # ONLY steps with `uses:` (no `run:` steps in the same job). If a `run:` - # step is present, the publish step fails with: - # "webapp: scorecard job must only have steps with uses" - # (49 estate repos hit this; see ROADMAP audit 2026-05-30.) - # - # Fix: split the threshold check into a downstream job that depends on - # `scorecard` and consumes the SARIF artifact. The `scorecard` job stays - # uses-only; `check-score` is the gating job that emits the error. - scorecard: - runs-on: ubuntu-latest - permissions: - security-events: write - id-token: write # For OIDC - steps: - - uses: actions/checkout@v7.0.1 - with: - persist-credentials: false - - - name: Run Scorecard - uses: ossf/scorecard-action@v2.5.0 - with: - results_file: results.sarif - results_format: sarif - publish_results: true - - - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v4.38.3 - with: - sarif_file: results.sarif - - - name: Persist SARIF for downstream score-gate job - uses: actions/upload-artifact@v7.0.2 - with: - name: scorecard-results - path: results.sarif - retention-days: 1 - - check-score: - needs: scorecard - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - name: Download SARIF from scorecard job - uses: actions/download-artifact@v8.0.2 - with: - name: scorecard-results - - - name: Check minimum score - run: | - SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0") - - echo "OpenSSF Scorecard Score: $SCORE" - - # Minimum acceptable score (0-10 scale) - MIN_SCORE=5 - - if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then - echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE" - exit 1 - fi - - # Check specific high-priority items - check-critical: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7.0.1 - - - name: Check SECURITY.md exists - run: | - if [ ! -f "SECURITY.md" ]; then - echo "::error::SECURITY.md is required" - exit 1 - fi - - - name: Check for pinned dependencies - run: | - # Check workflows for unpinned actions - unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true) - if [ -n "$unpinned" ]; then - echo "::warning::Found unpinned actions:" - echo "$unpinned" - fi