Ci/gitleaks self hosted fix - #393
Merged
Merged
Conversation
hyperpolymath
enabled auto-merge (squash)
June 21, 2026 00:07
hyperpolymath
disabled auto-merge
June 21, 2026 00:08
This was referenced Jun 21, 2026
hyperpolymath
added a commit
that referenced
this pull request
Jun 24, 2026
#393 cut governance-reusable.yml from 9 jobs to 2; branch-protection still requires the named `governance / *` contexts -> estate-wide phantom deadlock. Restores the 8 governance jobs (recovered from 5a93d9d~1), keeps the newer staleness/hypatia jobs, bumps stale checkout pins to v7.0.0. actionlint clean (exit 0). Re-emitting these already-required contexts can only unblock compliant repos and surface genuine drift on non-compliant ones.
hyperpolymath
added a commit
that referenced
this pull request
Aug 26, 2026
… detection is currently OFF) (#642) ## What happened Commit `5a93d9d5` — PR #393, *"Ci/gitleaks self hosted fix"*, 2026-06-21 — deleted the SARIF output and its upload step from this workflow **as collateral of an unrelated gitleaks refactor**. 93 lines removed from this file, in a commit about something else. Since then Scorecard has emitted `results_format: json` only. JSON feeds the public OpenSSF API and the badge; **SARIF is what feeds GitHub code scanning.** So: - ✅ the badge kept updating — which is exactly why nobody noticed - ❌ the Security tab has heard nothing for **~3 months** ## Measured, 2026-08-25 | | | |---|---| | Scorecard alerts in this repo | **all 12 frozen** at commit `3e57141d`, `updated_at` **2026-06-03** | | Hypatia alerts, same repo, for contrast | updated **2026-08-24** | | `scorecard.yml` runs since | **succeeded** 08-07 and 08-09, produced nothing | A comment left behind in the file still claimed `security-events: write` *"uploads the SARIF"*. That has been false since June, and it is why the breakage looked like correct configuration. ## The part that actually matters The stale alerts are cosmetic. **The real cost is that a genuinely new regression in pinned-dependencies, token-permissions or SAST would raise no alert at all.** Detection is off, not just untidy. ## Why this doesn't cost you the badge `publish_results` is **independent of `results_format`** — it publishes to the OpenSSF API either way. Switching the format back to SARIF keeps the badge *and* restores code scanning. Both outputs are live with this shape. ## Sequencing note Merge this **before** dismissing the 12 stale alerts. Once SARIF flows again, Scorecard re-reports and GitHub **auto-closes** the ones that are genuinely fixed — and at least 6 of the 12 are (5 fixed in code, 1 pointing at a file the avow-protocol eviction deleted). Better to let the machine close them correctly than to hand-dismiss things that aren't false positives. ## Lockfile Added the `codeql-action` entry for this workflow. Without it the workflow dies at 0s — a separate estate fault this change must not walk into. ## Estate-wide Memory records **545 frozen Scorecard alerts gating 106 repos**. This fixes the source for `standards`; the same deletion likely needs reverting wherever the reusable was copied rather than called. **Not self-merging** — this restores a security-detection capability and is your call. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.