fix(ci): restore the Scorecard SARIF upload deleted in June (security detection is currently OFF) - #642
Merged
Merged
Conversation
Commit 5a93d9d (PR #393, 'Ci/gitleaks self hosted fix', 2026-06-21) deleted the SARIF output and its upload step from scorecard-reusable.yml as collateral of an unrelated gitleaks refactor -- 93 lines removed from this file in a commit about something else. Since then Scorecard has emitted results_format: json only, which feeds the public OpenSSF API and the badge but NOT GitHub code scanning. So: * the badge kept updating, which is why nobody noticed * the Security tab has heard nothing for ~3 months MEASURED in this repo 2026-08-25: all 12 Scorecard alerts frozen at commit 3e57141, updated_at 2026-06-03, while Hypatia alerts in the same repo updated 2026-08-24. scorecard.yml ran SUCCESSFULLY on 08-07 and 08-09 and produced nothing. The worse half is not the stale alerts. It is that a genuinely NEW regression in pinned-dependencies, token-permissions or SAST would raise no alert at all. publish_results is independent of results_format, so switching to SARIF keeps the badge. Both outputs are live with this shape. Also adds the codeql-action lockfile entry for this workflow; without it the workflow would die at 0s, which is a separate estate fault this change must not walk into. Estate-wide context: memory records 545 frozen Scorecard alerts gating 106 repos. This fixes the source for standards; the same deletion likely needs reverting wherever else the reusable was copied rather than called. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
Commit
5a93d9d5— PR #393, "Ci/gitleaks self hosted fix", 2026-06-21 — deleted the SARIF output and its upload step from this workflow as collateral of an unrelated gitleaks refactor. 93 lines removed from this file, in a commit about something else.Since then Scorecard has emitted
results_format: jsononly. JSON feeds the public OpenSSF API and the badge; SARIF is what feeds GitHub code scanning. So:Measured, 2026-08-25
3e57141d,updated_at2026-06-03scorecard.ymlruns sinceA comment left behind in the file still claimed
security-events: write"uploads the SARIF". That has been false since June, and it is why the breakage looked like correct configuration.The part that actually matters
The stale alerts are cosmetic. The real cost is that a genuinely new regression in pinned-dependencies, token-permissions or SAST would raise no alert at all. Detection is off, not just untidy.
Why this doesn't cost you the badge
publish_resultsis independent ofresults_format— it publishes to the OpenSSF API either way. Switching the format back to SARIF keeps the badge and restores code scanning. Both outputs are live with this shape.Sequencing note
Merge this before dismissing the 12 stale alerts. Once SARIF flows again, Scorecard re-reports and GitHub auto-closes the ones that are genuinely fixed — and at least 6 of the 12 are (5 fixed in code, 1 pointing at a file the avow-protocol eviction deleted). Better to let the machine close them correctly than to hand-dismiss things that aren't false positives.
Lockfile
Added the
codeql-actionentry for this workflow. Without it the workflow dies at 0s — a separate estate fault this change must not walk into.Estate-wide
Memory records 545 frozen Scorecard alerts gating 106 repos. This fixes the source for
standards; the same deletion likely needs reverting wherever the reusable was copied rather than called.Not self-merging — this restores a security-detection capability and is your call.
🤖 Generated with Claude Code